e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2

Analysis

max time kernel
153s
max time network
59s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2.exe
Size

159KB
MD5

cbe583b8f1e2623f3d84ca051ad9a285
SHA1

623d7c79cb1f3cea1740f2e556f546c99f0705b9
SHA256

e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2
SHA512

b29bace87f535f6ffbe8c44ddaed22d51b511dcc09b4fb2b34b799e1e74b1d51d57050c23e0ce3a98aef46deda59714e0111f39c32dc890adfe98be0e9fd9f88
SSDEEP

3072:XK/kz6bycvuLIBs69/EeEDhpnM8nQ4aXRTM2WrVJzh/kPdeZbJIw87OAM:QiLIBvLCtJQvl7Gg+tIw87OAM

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

caycwq.exe

pid process

1992 caycwq.exe
Deletes itself 1 IoCs

Processes:

WScript.exe

pid process

632 WScript.exe

pid	process
1992	caycwq.exe

pid	process
632	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\caycwq.exe"	e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2.exe

Drops file in System32 directory 2 IoCs

Processes:

e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2.exe

description	ioc	process
File created	C:\Windows\SysWOW64\caycwq.exe	e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2.exe
File opened for modification	C:\Windows\SysWOW64\caycwq.exe	e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2.exe

description	pid	process	target process
PID 696 wrote to memory of 632	696	e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2.exe	WScript.exe
PID 696 wrote to memory of 632	696	e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2.exe	WScript.exe
PID 696 wrote to memory of 632	696	e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2.exe	WScript.exe
PID 696 wrote to memory of 632	696	e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2.exe
"C:\Users\Admin\AppData\Local\Temp\e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:696

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\1094.vbs"
2⤵
- Deletes itself
PID:632

C:\Windows\SysWOW64\caycwq.exe
C:\Windows\SysWOW64\caycwq.exe
1⤵
- Executes dropped EXE
PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1094.vbs
Filesize
500B

MD5
1ae26ecbd232cbc67c60fc00ee38aa83

SHA1
5c545c2c9c3ad78bc85999c8d03c00a99f8f797c

SHA256
3bd5aa4e03d7ed2c9ec364730b1dc29f5ef9e49f4d55314051e0c941f9b1fa81

SHA512
02c3ca3f315c6cc8c0618001474487fc1a4aa969861bfee64c6f9200c416cd653cbfdd90dd3ff82d8cbc3443f8ef7b1d2c2bad4164f71c985eaacb4083fe9974

Download Submit
C:\Windows\SysWOW64\caycwq.exe
Filesize
159KB

MD5
cbe583b8f1e2623f3d84ca051ad9a285

SHA1
623d7c79cb1f3cea1740f2e556f546c99f0705b9

SHA256
e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2

SHA512
b29bace87f535f6ffbe8c44ddaed22d51b511dcc09b4fb2b34b799e1e74b1d51d57050c23e0ce3a98aef46deda59714e0111f39c32dc890adfe98be0e9fd9f88

Download Submit
memory/632-59-0x0000000000000000-mapping.dmp

Download
memory/696-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/696-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1992-58-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1992-62-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download