Analysis
-
max time kernel
178s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 05:43
Static task
static1
Behavioral task
behavioral1
Sample
ewe.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ewe.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
ewe.exe
-
Size
947KB
-
MD5
b39bb6d5236d059f15e0c303119ac2ac
-
SHA1
169bbde66c91ec403e5378e3af49b7e038739a59
-
SHA256
bab8c0c9b3c3cebaa6f32565eadd1733308973fade84142c07bb1d5608fc6a0c
-
SHA512
c64992edf997a67981a1a8fa59176c1b8430668f31f86af546196e2944e477e8ff89ea298ccbc9b0cd4e7e5b5fd40f4f616b838c6e75e493854c5af6a545183c
-
SSDEEP
6144:CE0WCLnQX46PiAdNF5miUfnKk7gDaKIUzjmVqJE9/UxaGHXvI1N7nRl3kgbIpxC3:8WCLQIClF5mHKQSdiqosaG/8NpDAds
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\Mircca\\ogaru.exe," reg.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
ewe.exepid process 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe 4968 ewe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ewe.exedescription pid process Token: SeDebugPrivilege 4968 ewe.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
ewe.execmd.execmd.exedescription pid process target process PID 4968 wrote to memory of 2924 4968 ewe.exe cmd.exe PID 4968 wrote to memory of 2924 4968 ewe.exe cmd.exe PID 4968 wrote to memory of 2924 4968 ewe.exe cmd.exe PID 2924 wrote to memory of 3708 2924 cmd.exe PING.EXE PID 2924 wrote to memory of 3708 2924 cmd.exe PING.EXE PID 2924 wrote to memory of 3708 2924 cmd.exe PING.EXE PID 4968 wrote to memory of 4964 4968 ewe.exe cmd.exe PID 4968 wrote to memory of 4964 4968 ewe.exe cmd.exe PID 4968 wrote to memory of 4964 4968 ewe.exe cmd.exe PID 4964 wrote to memory of 2204 4964 cmd.exe PING.EXE PID 4964 wrote to memory of 2204 4964 cmd.exe PING.EXE PID 4964 wrote to memory of 2204 4964 cmd.exe PING.EXE PID 2924 wrote to memory of 3996 2924 cmd.exe reg.exe PID 2924 wrote to memory of 3996 2924 cmd.exe reg.exe PID 2924 wrote to memory of 3996 2924 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ewe.exe"C:\Users\Admin\AppData\Local\Temp\ewe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 39 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Mircca\ogaru.exe,"2⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 393⤵
- Runs ping.exe
PID:3708 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Mircca\ogaru.exe,"3⤵
- Modifies WinLogon for persistence
PID:3996 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 45 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ewe.exe" "C:\Users\Admin\AppData\Roaming\Mircca\ogaru.exe" && ping 127.0.0.1 -n 45 > nul && "C:\Users\Admin\AppData\Roaming\Mircca\ogaru.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 453⤵
- Runs ping.exe
PID:2204
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2204-140-0x0000000000000000-mapping.dmp
-
memory/2924-137-0x0000000000000000-mapping.dmp
-
memory/3708-138-0x0000000000000000-mapping.dmp
-
memory/3996-141-0x0000000000000000-mapping.dmp
-
memory/4964-139-0x0000000000000000-mapping.dmp
-
memory/4968-132-0x0000000000040000-0x0000000000132000-memory.dmpFilesize
968KB
-
memory/4968-133-0x0000000005440000-0x00000000059E4000-memory.dmpFilesize
5.6MB
-
memory/4968-134-0x0000000004F30000-0x0000000004FC2000-memory.dmpFilesize
584KB
-
memory/4968-135-0x0000000004FD0000-0x000000000506C000-memory.dmpFilesize
624KB
-
memory/4968-136-0x00000000067F0000-0x00000000067FA000-memory.dmpFilesize
40KB