86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603

Analysis

max time kernel
276s
max time network
324s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe
Size

76KB
MD5

07510ddcb4612db4de92501fc7cc8d0b
SHA1

86215d22b27c92a16e06ac1889036f755c376485
SHA256

86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603
SHA512

dca3d5ef2c705fc26843fd5a4b661c42b42060393b7ce60224d3405e2837012b0ea23f667d6d1fc4ca50afd35f5bbbbd653d64fb19ce7166acf9cf7d764bffc7
SSDEEP

768:bUHa+nv1F4Ik/jtAvHzL2bX6jeNCNCTD/uhg/yXYGH9pwjEgyfLwAqiw1iXCLT9A:mFFmjqvP22jeANCXMAyX70IDvwOU9ggm

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

zefheu.exe

pid process

604 zefheu.exe

pid	process
604	zefheu.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe

Drops file in Windows directory 2 IoCs

Processes:

86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe

description	ioc	process
File created	C:\Windows\zefheu.exe	86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe
File opened for modification	C:\Windows\zefheu.exe	86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe

description pid process

Token: SeIncBasePriorityPrivilege 5036 86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	5036	86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe

description	pid	process	target process
PID 5036 wrote to memory of 4432	5036	86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe	cmd.exe
PID 5036 wrote to memory of 4432	5036	86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe	cmd.exe
PID 5036 wrote to memory of 4432	5036	86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe
"C:\Users\Admin\AppData\Local\Temp\86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\864106~1.EXE > nul
2⤵
PID:4432

C:\Windows\zefheu.exe
C:\Windows\zefheu.exe
1⤵
- Executes dropped EXE
PID:604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\zefheu.exe

Filesize
76KB

MD5
07510ddcb4612db4de92501fc7cc8d0b

SHA1
86215d22b27c92a16e06ac1889036f755c376485

SHA256
86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603

SHA512
dca3d5ef2c705fc26843fd5a4b661c42b42060393b7ce60224d3405e2837012b0ea23f667d6d1fc4ca50afd35f5bbbbd653d64fb19ce7166acf9cf7d764bffc7

Download Submit
C:\Windows\zefheu.exe

Filesize
76KB

MD5
07510ddcb4612db4de92501fc7cc8d0b

SHA1
86215d22b27c92a16e06ac1889036f755c376485

SHA256
86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603

SHA512
dca3d5ef2c705fc26843fd5a4b661c42b42060393b7ce60224d3405e2837012b0ea23f667d6d1fc4ca50afd35f5bbbbd653d64fb19ce7166acf9cf7d764bffc7

Download Submit
memory/4432-134-0x0000000000000000-mapping.dmp

Download