Analysis
-
max time kernel
598s -
max time network
432s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27-10-2022 05:11
Static task
static1
Behavioral task
behavioral1
Sample
1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe
Resource
win7-20220901-en
windows7-x64
10 signatures
600 seconds
Behavioral task
behavioral2
Sample
1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
600 seconds
General
-
Target
1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe
-
Size
228KB
-
MD5
f37f9160e2cf021983080ee0046529be
-
SHA1
65095a67c453db178b5735e7ecbeccbf1338ed75
-
SHA256
1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4
-
SHA512
e02014e203c776bf8f11ebd48dc9abf132a8a907fa87e21b0f37306b0924f56dce99af7ed5fbcd862b3c6173c7cf09335c2fc1d4edc6f5753bd16bfdbab2d5de
-
SSDEEP
3072:at02MzGJiEWNgZEYCATuvcurAVI0XN0bHJJ2yMUp7JaHVKFqa:bNNguNATkAVI0iLFMiIKFqa
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1660 etkueec.exe -
Loads dropped DLL 2 IoCs
pid Process 1264 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 1264 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kghkndei = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Etkueect\\etkueec.exe\"" explorer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 584 PING.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1660 etkueec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeDebugPrivilege 1496 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1264 wrote to memory of 1660 1264 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 27 PID 1264 wrote to memory of 1660 1264 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 27 PID 1264 wrote to memory of 1660 1264 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 27 PID 1264 wrote to memory of 1660 1264 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 27 PID 1264 wrote to memory of 1568 1264 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 28 PID 1264 wrote to memory of 1568 1264 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 28 PID 1264 wrote to memory of 1568 1264 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 28 PID 1264 wrote to memory of 1568 1264 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 28 PID 1568 wrote to memory of 584 1568 cmd.exe 30 PID 1568 wrote to memory of 584 1568 cmd.exe 30 PID 1568 wrote to memory of 584 1568 cmd.exe 30 PID 1568 wrote to memory of 584 1568 cmd.exe 30 PID 1660 wrote to memory of 1496 1660 etkueec.exe 31 PID 1660 wrote to memory of 1496 1660 etkueec.exe 31 PID 1660 wrote to memory of 1496 1660 etkueec.exe 31 PID 1660 wrote to memory of 1496 1660 etkueec.exe 31 PID 1660 wrote to memory of 1496 1660 etkueec.exe 31 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1164 1496 explorer.exe 16 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1208 1496 explorer.exe 15 PID 1496 wrote to memory of 1068 1496 explorer.exe 18 PID 1496 wrote to memory of 1068 1496 explorer.exe 18
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe"C:\Users\Admin\AppData\Local\Temp\1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Roaming\Microsoft\Etkueect\etkueec.exeC:\Users\Admin\AppData\Roaming\Microsoft\Etkueect\etkueec.exe3⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\\System32\\autoconv.exe" > "C:\Users\Admin\AppData\Local\Temp\1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe" & del /F /Q "C:\Users\Admin\AppData\Local\Temp\1f7d74e5ccf5681021323717359f3⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.14⤵
- Runs ping.exe
PID:584
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1068
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79B
MD5a7192fc05c60e1387a85eeb15d50799c
SHA1f4cf194903e1675ef25cfe43b975347049e8e590
SHA256a3aae5fdb8f95b2bdac2b7d11df6118b281b055b7eec67faca0efc5ed6fe2224
SHA512fc7cda02030845aada3c48d1206f0f0903154e21b72817172a5e7c9344a183e4feba9cd4b03aec7bb99d156d72b1e10256c696310c41bbfa1d3f74fc9c37e060
-
Filesize
228KB
MD5f37f9160e2cf021983080ee0046529be
SHA165095a67c453db178b5735e7ecbeccbf1338ed75
SHA2561f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4
SHA512e02014e203c776bf8f11ebd48dc9abf132a8a907fa87e21b0f37306b0924f56dce99af7ed5fbcd862b3c6173c7cf09335c2fc1d4edc6f5753bd16bfdbab2d5de
-
Filesize
228KB
MD5f37f9160e2cf021983080ee0046529be
SHA165095a67c453db178b5735e7ecbeccbf1338ed75
SHA2561f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4
SHA512e02014e203c776bf8f11ebd48dc9abf132a8a907fa87e21b0f37306b0924f56dce99af7ed5fbcd862b3c6173c7cf09335c2fc1d4edc6f5753bd16bfdbab2d5de
-
Filesize
228KB
MD5f37f9160e2cf021983080ee0046529be
SHA165095a67c453db178b5735e7ecbeccbf1338ed75
SHA2561f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4
SHA512e02014e203c776bf8f11ebd48dc9abf132a8a907fa87e21b0f37306b0924f56dce99af7ed5fbcd862b3c6173c7cf09335c2fc1d4edc6f5753bd16bfdbab2d5de