Analysis
-
max time kernel
151s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 01:52
Static task
static1
Behavioral task
behavioral1
Sample
95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe
-
Size
228KB
-
MD5
70491582e2f585f49e445c92b6e5ce20
-
SHA1
f5ab02ab8c465324fe43f221de3177b1cf91a6cb
-
SHA256
95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b
-
SHA512
d73c89340f05dd2385bd82e88ba19ecb19c1a2c997139b0a39919c11a582a5d6c4ece501985b11f81378375f5abb9adc97fbc8ac4b47a75a38fe57c228b4fb89
-
SSDEEP
6144:1LoOYQfQolHQDinWTZqAukQJ3aCynEMOgL8y6Ero:t0nDinWTYAukQJ3pynEMOgL8y6R
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ttcev.exe -
Executes dropped EXE 1 IoCs
pid Process 8 ttcev.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe -
Adds Run key to start application 2 TTPs 11 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ttcev = "C:\\Users\\Admin\\ttcev.exe /j" ttcev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ttcev = "C:\\Users\\Admin\\ttcev.exe /b" ttcev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ttcev = "C:\\Users\\Admin\\ttcev.exe /z" ttcev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ttcev = "C:\\Users\\Admin\\ttcev.exe /m" ttcev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ttcev = "C:\\Users\\Admin\\ttcev.exe /a" ttcev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ttcev = "C:\\Users\\Admin\\ttcev.exe /l" ttcev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ttcev = "C:\\Users\\Admin\\ttcev.exe /x" ttcev.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ttcev = "C:\\Users\\Admin\\ttcev.exe /i" 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ttcev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ttcev = "C:\\Users\\Admin\\ttcev.exe /u" ttcev.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum ttcev.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 ttcev.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\c\autorun.inf ttcev.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe 8 ttcev.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 8 ttcev.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4008 wrote to memory of 8 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 80 PID 4008 wrote to memory of 8 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 80 PID 4008 wrote to memory of 8 4008 95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe"C:\Users\Admin\AppData\Local\Temp\95ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\ttcev.exe"C:\Users\Admin\ttcev.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:8
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD570491582e2f585f49e445c92b6e5ce20
SHA1f5ab02ab8c465324fe43f221de3177b1cf91a6cb
SHA25695ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b
SHA512d73c89340f05dd2385bd82e88ba19ecb19c1a2c997139b0a39919c11a582a5d6c4ece501985b11f81378375f5abb9adc97fbc8ac4b47a75a38fe57c228b4fb89
-
Filesize
228KB
MD570491582e2f585f49e445c92b6e5ce20
SHA1f5ab02ab8c465324fe43f221de3177b1cf91a6cb
SHA25695ce6a04e26d4adf72b63c0c84ab04f27d34175d923d8450d590940374b5d13b
SHA512d73c89340f05dd2385bd82e88ba19ecb19c1a2c997139b0a39919c11a582a5d6c4ece501985b11f81378375f5abb9adc97fbc8ac4b47a75a38fe57c228b4fb89