fef16c8d676b3351df78b94262c9437a02d40b63168231f6d4eb84b47152112b

Analysis

max time kernel
45s
max time network
61s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fef16c8d676b3351df78b94262c9437a02d40b63168231f6d4eb84b47152112b.exe
Size

273KB
MD5

de1af533ca8ba96b7d6cc15b5dbc9d41
SHA1

f5458e03184020de1cd8ea575fc84182749e9563
SHA256

fef16c8d676b3351df78b94262c9437a02d40b63168231f6d4eb84b47152112b
SHA512

e25c799694221478ca34cb6a1748ffd80c0f51cb587792a89af642447afd3b1f610f4c271ab25628c861e85ce2b15880cf5e9d8dbc7eaf4e4d4d2be6c50fc9e9
SSDEEP

6144:rf61LrPca5bOEOJ6+7BSJFOCAc9r4IkAm:rf613PccbO9J6+0DO5hcm

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
948	steamwebhelper.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\steamwebhelper = "C:\\Users\\Admin\\AppData\\Roaming\\steamwebhelper2\\steamwebhelper.exe"	fef16c8d676b3351df78b94262c9437a02d40b63168231f6d4eb84b47152112b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\steamwebhelper = "C:\\Users\\Admin\\AppData\\Roaming\\steamwebhelper2\\steamwebhelper.exe"	steamwebhelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1088	fef16c8d676b3351df78b94262c9437a02d40b63168231f6d4eb84b47152112b.exe
948	steamwebhelper.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	fef16c8d676b3351df78b94262c9437a02d40b63168231f6d4eb84b47152112b.exe
Token: SeDebugPrivilege	948	steamwebhelper.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 948	1088	fef16c8d676b3351df78b94262c9437a02d40b63168231f6d4eb84b47152112b.exe	28
PID 1088 wrote to memory of 948	1088	fef16c8d676b3351df78b94262c9437a02d40b63168231f6d4eb84b47152112b.exe	28
PID 1088 wrote to memory of 948	1088	fef16c8d676b3351df78b94262c9437a02d40b63168231f6d4eb84b47152112b.exe	28

C:\Users\Admin\AppData\Local\Temp\fef16c8d676b3351df78b94262c9437a02d40b63168231f6d4eb84b47152112b.exe
"C:\Users\Admin\AppData\Local\Temp\fef16c8d676b3351df78b94262c9437a02d40b63168231f6d4eb84b47152112b.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe
  "C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe

Filesize
273KB

MD5
de1af533ca8ba96b7d6cc15b5dbc9d41

SHA1
f5458e03184020de1cd8ea575fc84182749e9563

SHA256
fef16c8d676b3351df78b94262c9437a02d40b63168231f6d4eb84b47152112b

SHA512
e25c799694221478ca34cb6a1748ffd80c0f51cb587792a89af642447afd3b1f610f4c271ab25628c861e85ce2b15880cf5e9d8dbc7eaf4e4d4d2be6c50fc9e9

Download Submit
C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe

Filesize
273KB

MD5
de1af533ca8ba96b7d6cc15b5dbc9d41

SHA1
f5458e03184020de1cd8ea575fc84182749e9563

SHA256
fef16c8d676b3351df78b94262c9437a02d40b63168231f6d4eb84b47152112b

SHA512
e25c799694221478ca34cb6a1748ffd80c0f51cb587792a89af642447afd3b1f610f4c271ab25628c861e85ce2b15880cf5e9d8dbc7eaf4e4d4d2be6c50fc9e9

Download Submit
memory/948-60-0x00000000001F0000-0x000000000023A000-memory.dmp

Filesize
296KB

Download
memory/1088-54-0x0000000000270000-0x00000000002BA000-memory.dmp

Filesize
296KB

Download
memory/1088-55-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download
memory/1088-56-0x000007FEFB801000-0x000007FEFB803000-memory.dmp

Filesize
8KB

Download