ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe
Size

20KB
MD5

fbb4afddbd6dcdcd5e3bb622ff8922d7
SHA1

56a15933006719219f8bdc7f8c65fcfb5305b482
SHA256

ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08
SHA512

5dae535edf4e6c58cfcf9b0a79cb7b1374056bdd8601d7559bc77c82ba067eb33519fa58d50e9a38851545b9b835c4778272483da6732127eebd0167ba074964
SSDEEP

192:TVTtwNpAGWTawIcJkjBRP1oyn7MU859xdto9KZjzy:4PWxIcyL1hd8TPto9KJzy

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

uegjy.exe

pid process

1432 uegjy.exe
Deletes itself 1 IoCs

Processes:

uegjy.exe

pid process

1432 uegjy.exe

pid	process
1432	uegjy.exe

pid	process
1432	uegjy.exe

Loads dropped DLL 2 IoCs

Processes:

ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe

pid	process
1632	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe
1632	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe

description	pid	process	target process
PID 1632 wrote to memory of 1432	1632	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe	uegjy.exe
PID 1632 wrote to memory of 1432	1632	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe	uegjy.exe
PID 1632 wrote to memory of 1432	1632	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe	uegjy.exe
PID 1632 wrote to memory of 1432	1632	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe	uegjy.exe

C:\Users\Admin\AppData\Local\Temp\ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe
"C:\Users\Admin\AppData\Local\Temp\ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\uegjy.exe
"C:\Users\Admin\AppData\Local\Temp\uegjy.exe"
2⤵
- Executes dropped EXE
- Deletes itself
PID:1432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\uegjy.exe

Filesize
20KB

MD5
d74a276525cc6218ac3473bf76c8f1e3

SHA1
a4c6033e65820472f7204974286e2d9e14a03ded

SHA256
832e4fc9a1fc70e9652a25cf6a3a025443c02efbd8c05e904e1b14244258676d

SHA512
9745f12967ceda2fb6557281050ce0aaec36b776bc41c974a0bac6a15e75a0c85908349f46522550c2610124115f4507ed8b811850e926293e2ddcfa13543a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\uegjy.exe

Filesize
20KB

MD5
d74a276525cc6218ac3473bf76c8f1e3

SHA1
a4c6033e65820472f7204974286e2d9e14a03ded

SHA256
832e4fc9a1fc70e9652a25cf6a3a025443c02efbd8c05e904e1b14244258676d

SHA512
9745f12967ceda2fb6557281050ce0aaec36b776bc41c974a0bac6a15e75a0c85908349f46522550c2610124115f4507ed8b811850e926293e2ddcfa13543a4b

Download Submit
\Users\Admin\AppData\Local\Temp\uegjy.exe

Filesize
20KB

MD5
d74a276525cc6218ac3473bf76c8f1e3

SHA1
a4c6033e65820472f7204974286e2d9e14a03ded

SHA256
832e4fc9a1fc70e9652a25cf6a3a025443c02efbd8c05e904e1b14244258676d

SHA512
9745f12967ceda2fb6557281050ce0aaec36b776bc41c974a0bac6a15e75a0c85908349f46522550c2610124115f4507ed8b811850e926293e2ddcfa13543a4b

Download Submit
\Users\Admin\AppData\Local\Temp\uegjy.exe

Filesize
20KB

MD5
d74a276525cc6218ac3473bf76c8f1e3

SHA1
a4c6033e65820472f7204974286e2d9e14a03ded

SHA256
832e4fc9a1fc70e9652a25cf6a3a025443c02efbd8c05e904e1b14244258676d

SHA512
9745f12967ceda2fb6557281050ce0aaec36b776bc41c974a0bac6a15e75a0c85908349f46522550c2610124115f4507ed8b811850e926293e2ddcfa13543a4b

Download Submit
memory/1432-57-0x0000000000000000-mapping.dmp

Download
memory/1632-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download