ecf14ffceb6140d4be7e16f0a5f622bd18177a285a44fa0d8e35aad56c63767e

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ecf14ffceb6140d4be7e16f0a5f622bd18177a285a44fa0d8e35aad56c63767e.exe
Size 993KB
Sample221012-vn9yaachcp
SHA256 ecf14ffceb6140d4be7e16f0a5f622bd18177a285a44fa0d8e35aad56c63767e
MD5 7d42677fc239c680072d15890a8c5410
SHA1 3f35ba4c1dc548cd34c95e136cbfe0b8cfada3e8
SHA512 3d2d0858fa329eb59c9e8f99627e1a37f1b59c5a75a901cceae88b002d3f0d2c259843141c07929667ed2c257d122857dac28fb78e25e02ed178bee8e573cc31
SSDEEP 24576:enyoo5DoPjLc4v0O9UBpBApdhnTQ08FahVGnB8H:envj0QXdhnTQ08FainU
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1504	keygen.exe
3936	c.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0004000000022e27-134.dat	upx
behavioral2/files/0x0004000000022e27-133.dat	upx
behavioral2/memory/1504-136-0x0000000000F10000-0x0000000000F28000-memory.dmp	upx
behavioral2/files/0x0002000000022e30-138.dat	upx
behavioral2/files/0x0002000000022e30-137.dat	upx
behavioral2/memory/3936-141-0x0000000000400000-0x0000000000710000-memory.dmp	upx
behavioral2/memory/3936-144-0x0000000000400000-0x0000000000710000-memory.dmp	upx
behavioral2/memory/1504-145-0x0000000000F10000-0x0000000000F28000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	ecf14ffceb6140d4be7e16f0a5f622bd18177a285a44fa0d8e35aad56c63767e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3260	3936	WerFault.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3936	c.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 1504	4996	ecf14ffceb6140d4be7e16f0a5f622bd18177a285a44fa0d8e35aad56c63767e.exe	83
PID 4996 wrote to memory of 1504	4996	ecf14ffceb6140d4be7e16f0a5f622bd18177a285a44fa0d8e35aad56c63767e.exe	83
PID 4996 wrote to memory of 1504	4996	ecf14ffceb6140d4be7e16f0a5f622bd18177a285a44fa0d8e35aad56c63767e.exe	83
PID 4996 wrote to memory of 3936	4996	ecf14ffceb6140d4be7e16f0a5f622bd18177a285a44fa0d8e35aad56c63767e.exe	84
PID 4996 wrote to memory of 3936	4996	ecf14ffceb6140d4be7e16f0a5f622bd18177a285a44fa0d8e35aad56c63767e.exe	84
PID 4996 wrote to memory of 3936	4996	ecf14ffceb6140d4be7e16f0a5f622bd18177a285a44fa0d8e35aad56c63767e.exe	84

C:\Users\Admin\AppData\Local\Temp\ecf14ffceb6140d4be7e16f0a5f622bd18177a285a44fa0d8e35aad56c63767e.exe
"C:\Users\Admin\AppData\Local\Temp\ecf14ffceb6140d4be7e16f0a5f622bd18177a285a44fa0d8e35aad56c63767e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  "C:\Users\Admin\AppData\Local\Temp\keygen.exe"
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Users\Admin\AppData\Local\Temp\c.exe
  "C:\Users\Admin\AppData\Local\Temp\c.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 464
    3⤵
    - Program crash
    PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3936 -ip 3936
1⤵
PID:2184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c.exe

Path C:\Users\Admin\AppData\Local\Temp\c.exe
Size 941KB
SHA256 867b485a107f98d9beb1100921716321c575c1aeffb673aa3af56f28e873fbec
MD5 732a902d8e4c99ec011e54568bff180e
SHA1 0650d5bec1c983c1fdfa302ef39fe7bd95ca46c8
SHA512 f9ebb40e915c4a950afce59830a6f81df0266c7333ae7b250af595d1b5612ba0f55806998892507c290391481580f2f7ce7df85f37344848ff527060a542d85d
SSDEEP 24576:u/bo5QovoFcXvlOuUBpB/YduYSQnMOahMpnO87R:xoe9LduYSQnMOaGn3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

c.exe

Path C:\Users\Admin\AppData\Local\Temp\c.exe
Size 941KB
SHA256 867b485a107f98d9beb1100921716321c575c1aeffb673aa3af56f28e873fbec
MD5 732a902d8e4c99ec011e54568bff180e
SHA1 0650d5bec1c983c1fdfa302ef39fe7bd95ca46c8
SHA512 f9ebb40e915c4a950afce59830a6f81df0266c7333ae7b250af595d1b5612ba0f55806998892507c290391481580f2f7ce7df85f37344848ff527060a542d85d
SSDEEP 24576:u/bo5QovoFcXvlOuUBpB/YduYSQnMOahMpnO87R:xoe9LduYSQnMOaGn3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 42KB
SHA256 4e0bb0b5faa17f86524919b323f178b64ac52dc1a852f76f6a8c4f8cc8ea2916
MD5 18a24fcdcd61db7931c2dbd133022e4a
SHA1 7113229040e1a7405c5165c72753ac295c9f0cba
SHA512 68166e62d9da3cd082e49a44ddda82c2b6f6adeabfa385519bf4a1dd558c7d566df672650b066b7741e5d256b633ddd9f3be0cc35c9157064520ab94891bfc90
SSDEEP 768:537HYksVIBlxTii4BGYjw3XDtl8tIG75lKJ8KMTdfFt9O+XxbTGjt:xYVQlxTiiajgDtCtICPZFftXxPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 42KB
SHA256 4e0bb0b5faa17f86524919b323f178b64ac52dc1a852f76f6a8c4f8cc8ea2916
MD5 18a24fcdcd61db7931c2dbd133022e4a
SHA1 7113229040e1a7405c5165c72753ac295c9f0cba
SHA512 68166e62d9da3cd082e49a44ddda82c2b6f6adeabfa385519bf4a1dd558c7d566df672650b066b7741e5d256b633ddd9f3be0cc35c9157064520ab94891bfc90
SSDEEP 768:537HYksVIBlxTii4BGYjw3XDtl8tIG75lKJ8KMTdfFt9O+XxbTGjt:xYVQlxTiiajgDtCtICPZFftXxPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1504-136-0x0000000000F10000-0x0000000000F28000-memory.dmp

Download

memory/1504-145-0x0000000000F10000-0x0000000000F28000-memory.dmp

Download

memory/3936-141-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3936-142-0x0000000000946000-0x0000000000948000-memory.dmp

Download

memory/3936-143-0x0000000000946000-0x0000000000948000-memory.dmp

Download

memory/3936-144-0x0000000000400000-0x0000000000710000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads