7c6cba5b9d9443e59f197b66ad8915bd0b98f3da20eba149f0bf5af3ec7c5a2e

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c6cba5b9d9443e59f197b66ad8915bd0b98f3da20eba149f0bf5af3ec7c5a2e.exe
Size

90KB
MD5

64c1ca809f3bd60278231c983407309d
SHA1

1900feaff1e2ae5f8af1d7bd2ad0961c04107969
SHA256

7c6cba5b9d9443e59f197b66ad8915bd0b98f3da20eba149f0bf5af3ec7c5a2e
SHA512

53ea6ea68382868bda7d2a47e0590dee55e30c27f24fcbcf6da02b7f7739781adfe3640ec2c6d2ca774e18ec63e50af57da62c3007e055dcae21f2464c8b963c
SSDEEP

1536:+tdwiFJBHoeeCF2wNRgR/G2J7kPIPm3yCJK/Hw5zEy:+tKe1FYORgVrJ7kw+3zJ6c

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

server.exezhunquel.exesvchoost.exemeciew.exe

pid process

4756 server.exe
1684 zhunquel.exe
4948 svchoost.exe
4936 meciew.exe

pid	process
4756	server.exe
1684	zhunquel.exe
4948	svchoost.exe
4936	meciew.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7c6cba5b9d9443e59f197b66ad8915bd0b98f3da20eba149f0bf5af3ec7c5a2e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	7c6cba5b9d9443e59f197b66ad8915bd0b98f3da20eba149f0bf5af3ec7c5a2e.exe

Loads dropped DLL 1 IoCs

Processes:

meciew.exe

pid process

4936 meciew.exe

pid	process
4936	meciew.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchoost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\svchoost.exe"	svchoost.exe

Drops file in System32 directory 3 IoCs

Processes:

server.exemeciew.exe

description	ioc	process
File created	C:\Windows\SysWOW64\meciew.exe	server.exe
File opened for modification	C:\Windows\SysWOW64\meciew.exe	server.exe
File created	C:\Windows\SysWOW64\gei33.dll	meciew.exe

Drops file in Windows directory 2 IoCs

Processes:

zhunquel.exe

description ioc process

File created C:\Windows\svchoost.exe zhunquel.exe
File opened for modification C:\Windows\svchoost.exe zhunquel.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\svchoost.exe	zhunquel.exe
File opened for modification	C:\Windows\svchoost.exe	zhunquel.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchoost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchoost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchoost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

zhunquel.exe

description pid process

Token: SeIncBasePriorityPrivilege 1684 zhunquel.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1684	zhunquel.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

7c6cba5b9d9443e59f197b66ad8915bd0b98f3da20eba149f0bf5af3ec7c5a2e.exezhunquel.exe

description	pid	process	target process
PID 4236 wrote to memory of 4756	4236	7c6cba5b9d9443e59f197b66ad8915bd0b98f3da20eba149f0bf5af3ec7c5a2e.exe	server.exe
PID 4236 wrote to memory of 4756	4236	7c6cba5b9d9443e59f197b66ad8915bd0b98f3da20eba149f0bf5af3ec7c5a2e.exe	server.exe
PID 4236 wrote to memory of 4756	4236	7c6cba5b9d9443e59f197b66ad8915bd0b98f3da20eba149f0bf5af3ec7c5a2e.exe	server.exe
PID 4236 wrote to memory of 1684	4236	7c6cba5b9d9443e59f197b66ad8915bd0b98f3da20eba149f0bf5af3ec7c5a2e.exe	zhunquel.exe
PID 4236 wrote to memory of 1684	4236	7c6cba5b9d9443e59f197b66ad8915bd0b98f3da20eba149f0bf5af3ec7c5a2e.exe	zhunquel.exe
PID 4236 wrote to memory of 1684	4236	7c6cba5b9d9443e59f197b66ad8915bd0b98f3da20eba149f0bf5af3ec7c5a2e.exe	zhunquel.exe
PID 1684 wrote to memory of 4948	1684	zhunquel.exe	svchoost.exe
PID 1684 wrote to memory of 4948	1684	zhunquel.exe	svchoost.exe
PID 1684 wrote to memory of 4948	1684	zhunquel.exe	svchoost.exe
PID 1684 wrote to memory of 4868	1684	zhunquel.exe	cmd.exe
PID 1684 wrote to memory of 4868	1684	zhunquel.exe	cmd.exe
PID 1684 wrote to memory of 4868	1684	zhunquel.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\7c6cba5b9d9443e59f197b66ad8915bd0b98f3da20eba149f0bf5af3ec7c5a2e.exe
"C:\Users\Admin\AppData\Local\Temp\7c6cba5b9d9443e59f197b66ad8915bd0b98f3da20eba149f0bf5af3ec7c5a2e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4236

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4756

C:\Users\Admin\AppData\Local\Temp\zhunquel.exe
"C:\Users\Admin\AppData\Local\Temp\zhunquel.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\svchoost.exe
"C:\Windows\svchoost.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
PID:4948

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\zhunquel.exe > nul
3⤵
PID:4868

C:\Windows\SysWOW64\meciew.exe
C:\Windows\SysWOW64\meciew.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:4936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
48KB

MD5
2c1917403d113d83404f898ae71939d2

SHA1
8e8dcba29fa8453244a6bc2323247f746d42b2d2

SHA256
2b45aa333f5648ce0e14b35c3d0b2096a48734595c9a894e777429ca8c03c977

SHA512
b93c7f45fd578e851a5b9d77e80b8ea1f991aa0c351e2eabc386f96adda564699f12db0d64767429212087efcaf6cfe931f6242b007f9ed3578babb601a298f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
48KB

MD5
2c1917403d113d83404f898ae71939d2

SHA1
8e8dcba29fa8453244a6bc2323247f746d42b2d2

SHA256
2b45aa333f5648ce0e14b35c3d0b2096a48734595c9a894e777429ca8c03c977

SHA512
b93c7f45fd578e851a5b9d77e80b8ea1f991aa0c351e2eabc386f96adda564699f12db0d64767429212087efcaf6cfe931f6242b007f9ed3578babb601a298f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\zhunquel.exe
Filesize
52KB

MD5
bb2e482ad846d9580af1fe199564e92e

SHA1
f51b3ac4ef1cd2850a584786fcdf4080fffda782

SHA256
32d6cf30b2e844d40a43b0959370d654fb295336dacbe1553532b1ab8d01a825

SHA512
315229731a43d3a6587e641b9bc37da4ff0c9dcb5d8380caffa49ff7985a648c3f6953751970e573d8a94984057643bec031b2a7109c88720d66698e3927fb37

Download Submit
C:\Users\Admin\AppData\Local\Temp\zhunquel.exe
Filesize
52KB

MD5
bb2e482ad846d9580af1fe199564e92e

SHA1
f51b3ac4ef1cd2850a584786fcdf4080fffda782

SHA256
32d6cf30b2e844d40a43b0959370d654fb295336dacbe1553532b1ab8d01a825

SHA512
315229731a43d3a6587e641b9bc37da4ff0c9dcb5d8380caffa49ff7985a648c3f6953751970e573d8a94984057643bec031b2a7109c88720d66698e3927fb37

Download Submit
C:\Windows\SysWOW64\gei33.dll
Filesize
58KB

MD5
63f4ce502bba6a10d20b5affb92dc3d2

SHA1
404468f5485f2786735ffbf6ab055856f6cf29e1

SHA256
5caaf07e970e0abd2dfdb250177febe8ba8ca9cf6dfb09f6c498d4ae96187bc6

SHA512
2c9a5d5d20c4432bd9f8c8b8ffa7d0acc1d0f07d05f6d1ea21fcb417f1ccef9ef7c4406988b06a483cd1102b411635a3f9e69bc833d307675a10f5b920def9b3

Download Submit
C:\Windows\SysWOW64\meciew.exe
Filesize
48KB

MD5
2c1917403d113d83404f898ae71939d2

SHA1
8e8dcba29fa8453244a6bc2323247f746d42b2d2

SHA256
2b45aa333f5648ce0e14b35c3d0b2096a48734595c9a894e777429ca8c03c977

SHA512
b93c7f45fd578e851a5b9d77e80b8ea1f991aa0c351e2eabc386f96adda564699f12db0d64767429212087efcaf6cfe931f6242b007f9ed3578babb601a298f4

Download Submit
C:\Windows\SysWOW64\meciew.exe
Filesize
48KB

MD5
2c1917403d113d83404f898ae71939d2

SHA1
8e8dcba29fa8453244a6bc2323247f746d42b2d2

SHA256
2b45aa333f5648ce0e14b35c3d0b2096a48734595c9a894e777429ca8c03c977

SHA512
b93c7f45fd578e851a5b9d77e80b8ea1f991aa0c351e2eabc386f96adda564699f12db0d64767429212087efcaf6cfe931f6242b007f9ed3578babb601a298f4

Download Submit
C:\Windows\svchoost.exe
Filesize
52KB

MD5
bb2e482ad846d9580af1fe199564e92e

SHA1
f51b3ac4ef1cd2850a584786fcdf4080fffda782

SHA256
32d6cf30b2e844d40a43b0959370d654fb295336dacbe1553532b1ab8d01a825

SHA512
315229731a43d3a6587e641b9bc37da4ff0c9dcb5d8380caffa49ff7985a648c3f6953751970e573d8a94984057643bec031b2a7109c88720d66698e3927fb37

Download Submit
C:\Windows\svchoost.exe
Filesize
52KB

MD5
bb2e482ad846d9580af1fe199564e92e

SHA1
f51b3ac4ef1cd2850a584786fcdf4080fffda782

SHA256
32d6cf30b2e844d40a43b0959370d654fb295336dacbe1553532b1ab8d01a825

SHA512
315229731a43d3a6587e641b9bc37da4ff0c9dcb5d8380caffa49ff7985a648c3f6953751970e573d8a94984057643bec031b2a7109c88720d66698e3927fb37

Download Submit
memory/1684-136-0x0000000000000000-mapping.dmp

Download
memory/4236-132-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4236-139-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4756-133-0x0000000000000000-mapping.dmp

Download
memory/4868-143-0x0000000000000000-mapping.dmp

Download
memory/4948-140-0x0000000000000000-mapping.dmp

Download