ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08

Analysis

max time kernel
205s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe
Size

20KB
MD5

fbb4afddbd6dcdcd5e3bb622ff8922d7
SHA1

56a15933006719219f8bdc7f8c65fcfb5305b482
SHA256

ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08
SHA512

5dae535edf4e6c58cfcf9b0a79cb7b1374056bdd8601d7559bc77c82ba067eb33519fa58d50e9a38851545b9b835c4778272483da6732127eebd0167ba074964
SSDEEP

192:TVTtwNpAGWTawIcJkjBRP1oyn7MU859xdto9KZjzy:4PWxIcyL1hd8TPto9KJzy

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

uegjy.exe

pid process

344 uegjy.exe

pid	process
344	uegjy.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe

description	pid	process	target process
PID 1908 wrote to memory of 344	1908	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe	uegjy.exe
PID 1908 wrote to memory of 344	1908	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe	uegjy.exe
PID 1908 wrote to memory of 344	1908	ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe	uegjy.exe

C:\Users\Admin\AppData\Local\Temp\ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe
"C:\Users\Admin\AppData\Local\Temp\ec4f6cd877dc06ceb6f51d95a9a90ef9ae50636d76ee6a655f58ad9e633ebe08.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\uegjy.exe
"C:\Users\Admin\AppData\Local\Temp\uegjy.exe"
2⤵
- Executes dropped EXE
PID:344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\uegjy.exe

Filesize
20KB

MD5
d74a276525cc6218ac3473bf76c8f1e3

SHA1
a4c6033e65820472f7204974286e2d9e14a03ded

SHA256
832e4fc9a1fc70e9652a25cf6a3a025443c02efbd8c05e904e1b14244258676d

SHA512
9745f12967ceda2fb6557281050ce0aaec36b776bc41c974a0bac6a15e75a0c85908349f46522550c2610124115f4507ed8b811850e926293e2ddcfa13543a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\uegjy.exe

Filesize
20KB

MD5
d74a276525cc6218ac3473bf76c8f1e3

SHA1
a4c6033e65820472f7204974286e2d9e14a03ded

SHA256
832e4fc9a1fc70e9652a25cf6a3a025443c02efbd8c05e904e1b14244258676d

SHA512
9745f12967ceda2fb6557281050ce0aaec36b776bc41c974a0bac6a15e75a0c85908349f46522550c2610124115f4507ed8b811850e926293e2ddcfa13543a4b

Download Submit
memory/344-132-0x0000000000000000-mapping.dmp

Download