9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d

Analysis

max time kernel
161s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe
Size

76KB
MD5

acafd6eeeff08835eb0814df866559d1
SHA1

e54596368a2ae61cc5929c73eb46b13d7ac0ee0b
SHA256

9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d
SHA512

f07ceb6e38f980f5a6a050d6d6999a4bfa8e81767f47222c6203539d50e761dd194dcfe0e7ab39324e240a88497e373bf57fe5d6bff7d42d0fc5bd254381336d
SSDEEP

768:bUHa+nv1F4Ik/jtAvHzL2bX6jeNCNCTD/ubg/yXYGH9pwjEgyfLwAqiw1iXCLT9A:mFFmjqvP22jeANCXOAyX70IDvwOU9ggm

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

kcimci.exe

pid process

4792 kcimci.exe

pid	process
4792	kcimci.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe

Drops file in Windows directory 2 IoCs

Processes:

9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe

description	ioc	process
File created	C:\Windows\kcimci.exe	9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe
File opened for modification	C:\Windows\kcimci.exe	9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe

description pid process

Token: SeIncBasePriorityPrivilege 4772 9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	4772	9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe

description	pid	process	target process
PID 4772 wrote to memory of 1512	4772	9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe	cmd.exe
PID 4772 wrote to memory of 1512	4772	9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe	cmd.exe
PID 4772 wrote to memory of 1512	4772	9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe
"C:\Users\Admin\AppData\Local\Temp\9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9CE811~1.EXE > nul
2⤵
PID:1512

C:\Windows\kcimci.exe
C:\Windows\kcimci.exe
1⤵
- Executes dropped EXE
PID:4792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\kcimci.exe

Filesize
76KB

MD5
acafd6eeeff08835eb0814df866559d1

SHA1
e54596368a2ae61cc5929c73eb46b13d7ac0ee0b

SHA256
9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d

SHA512
f07ceb6e38f980f5a6a050d6d6999a4bfa8e81767f47222c6203539d50e761dd194dcfe0e7ab39324e240a88497e373bf57fe5d6bff7d42d0fc5bd254381336d

Download Submit
C:\Windows\kcimci.exe

Filesize
76KB

MD5
acafd6eeeff08835eb0814df866559d1

SHA1
e54596368a2ae61cc5929c73eb46b13d7ac0ee0b

SHA256
9ce8118a01fdd1d15a9abeae2a3437b0bf8ef160ddf4e974b7d71520da4f2f2d

SHA512
f07ceb6e38f980f5a6a050d6d6999a4bfa8e81767f47222c6203539d50e761dd194dcfe0e7ab39324e240a88497e373bf57fe5d6bff7d42d0fc5bd254381336d

Download Submit
memory/1512-134-0x0000000000000000-mapping.dmp

Download