ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe
Size

20KB
MD5

fbb4afddbd6dcdcd5e3bb622ff8922d7
SHA1

56a15933006719219f8bdc7f8c65fcfb5305b482
SHA256

ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08
SHA512

5dae535edf4e6c58cfcf9b0a79cb7b1374056bdd8601d7559bc77c82ba067eb33519fa58d50e9a38851545b9b835c4778272483da6732127eebd0167ba074964
SSDEEP

192:TVTtwNpAGWTawIcJkjBRP1oyn7MU859xdto9KZjzy:4PWxIcyL1hd8TPto9KJzy

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

uegjy.exe

pid process

1432 uegjy.exe
Deletes itself 1 IoCs

Processes:

uegjy.exe

pid process

1432 uegjy.exe

pid	process
1432	uegjy.exe

pid	process
1432	uegjy.exe

Loads dropped DLL 2 IoCs

Processes:

ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe

pid	process
1632	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe
1632	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe

description	pid	process	target process
PID 1632 wrote to memory of 1432	1632	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe	uegjy.exe
PID 1632 wrote to memory of 1432	1632	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe	uegjy.exe
PID 1632 wrote to memory of 1432	1632	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe	uegjy.exe
PID 1632 wrote to memory of 1432	1632	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe	uegjy.exe

C:\Users\Admin\AppData\Local\Temp\ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe
"C:\Users\Admin\AppData\Local\Temp\ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\uegjy.exe
"C:\Users\Admin\AppData\Local\Temp\uegjy.exe"
2⤵
- Executes dropped EXE
- Deletes itself
PID:1432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\uegjy.exe
Filesize
20KB

MD5
d74a276525cc6218ac3473bf76c8f1e3

SHA1
a4c6033e65820472f7204974286e2d9e14a03ded

SHA256
832e4fc9a1fc70e9652a25cf6a3a025443c02efbd8c05e904e1b14244258676d

SHA512
9745f12967ceda2fb6557281050ce0aaec36b776bc41c974a0bac6a15e75a0c85908349f46522550c2610124115f4507ed8b811850e926293e2ddcfa13543a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\uegjy.exe
Filesize
20KB

MD5
d74a276525cc6218ac3473bf76c8f1e3

SHA1
a4c6033e65820472f7204974286e2d9e14a03ded

SHA256
832e4fc9a1fc70e9652a25cf6a3a025443c02efbd8c05e904e1b14244258676d

SHA512
9745f12967ceda2fb6557281050ce0aaec36b776bc41c974a0bac6a15e75a0c85908349f46522550c2610124115f4507ed8b811850e926293e2ddcfa13543a4b

Download Submit
\Users\Admin\AppData\Local\Temp\uegjy.exe
Filesize
20KB

MD5
d74a276525cc6218ac3473bf76c8f1e3

SHA1
a4c6033e65820472f7204974286e2d9e14a03ded

SHA256
832e4fc9a1fc70e9652a25cf6a3a025443c02efbd8c05e904e1b14244258676d

SHA512
9745f12967ceda2fb6557281050ce0aaec36b776bc41c974a0bac6a15e75a0c85908349f46522550c2610124115f4507ed8b811850e926293e2ddcfa13543a4b

Download Submit
\Users\Admin\AppData\Local\Temp\uegjy.exe
Filesize
20KB

MD5
d74a276525cc6218ac3473bf76c8f1e3

SHA1
a4c6033e65820472f7204974286e2d9e14a03ded

SHA256
832e4fc9a1fc70e9652a25cf6a3a025443c02efbd8c05e904e1b14244258676d

SHA512
9745f12967ceda2fb6557281050ce0aaec36b776bc41c974a0bac6a15e75a0c85908349f46522550c2610124115f4507ed8b811850e926293e2ddcfa13543a4b

Download Submit
memory/1432-57-0x0000000000000000-mapping.dmp

Download
memory/1632-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download