Analysis
-
max time kernel
134s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 17:53
Static task
static1
Behavioral task
behavioral1
Sample
463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe
Resource
win7-20221111-en
General
-
Target
463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe
-
Size
156KB
-
MD5
e1be214ce87788d6b58859e365a22e98
-
SHA1
6ef6b9744819e9ca50e68bfdd35f3bd0d63ec69e
-
SHA256
463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2
-
SHA512
b86ca241fb1ce4de25dfd4c61cfefed3cda1d2f958644f66e29f68ee21f517b3990c184a205f787067bf05b29d58ff2b74c3a70a41a552f2d867b1465bf3cb2a
-
SSDEEP
3072:QB5CejoX8HmmFkzAEulAxBEsNIOQjUhm6my37RqQ9:KEnMtcpu6mO3r37RB
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
emitcch.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat emitcch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 18 IoCs
Processes:
emitcch.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections emitcch.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{423E2C3A-0A18-4186-8DC8-103F189F6C6E}\WpadDecision = "0" emitcch.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{423E2C3A-0A18-4186-8DC8-103F189F6C6E} emitcch.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-e9-a5-a8-90-df emitcch.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-e9-a5-a8-90-df\WpadDecisionReason = "1" emitcch.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0033000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 emitcch.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{423E2C3A-0A18-4186-8DC8-103F189F6C6E}\WpadDecisionReason = "1" emitcch.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{423E2C3A-0A18-4186-8DC8-103F189F6C6E}\WpadDecisionTime = 80ef63ec7c06d901 emitcch.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{423E2C3A-0A18-4186-8DC8-103F189F6C6E}\a2-e9-a5-a8-90-df emitcch.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-e9-a5-a8-90-df\WpadDecisionTime = 80ef63ec7c06d901 emitcch.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings emitcch.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 emitcch.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad emitcch.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{423E2C3A-0A18-4186-8DC8-103F189F6C6E}\WpadNetworkName = "Network 2" emitcch.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-e9-a5-a8-90-df\WpadDecision = "0" emitcch.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 emitcch.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings emitcch.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" emitcch.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exeemitcch.exeemitcch.exepid process 1668 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe 1384 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe 1920 emitcch.exe 1500 emitcch.exe 1500 emitcch.exe 1500 emitcch.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exepid process 1384 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exeemitcch.exedescription pid process target process PID 1668 wrote to memory of 1384 1668 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe PID 1668 wrote to memory of 1384 1668 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe PID 1668 wrote to memory of 1384 1668 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe PID 1668 wrote to memory of 1384 1668 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe PID 1920 wrote to memory of 1500 1920 emitcch.exe emitcch.exe PID 1920 wrote to memory of 1500 1920 emitcch.exe emitcch.exe PID 1920 wrote to memory of 1500 1920 emitcch.exe emitcch.exe PID 1920 wrote to memory of 1500 1920 emitcch.exe emitcch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe"C:\Users\Admin\AppData\Local\Temp\463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe"C:\Users\Admin\AppData\Local\Temp\463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\emitcch.exe"C:\Windows\SysWOW64\emitcch.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\emitcch.exe"C:\Windows\SysWOW64\emitcch.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1384-68-0x0000000000290000-0x00000000002A0000-memory.dmpFilesize
64KB
-
memory/1384-86-0x0000000000250000-0x0000000000267000-memory.dmpFilesize
92KB
-
memory/1384-59-0x0000000000000000-mapping.dmp
-
memory/1384-60-0x0000000000270000-0x0000000000287000-memory.dmpFilesize
92KB
-
memory/1384-64-0x0000000000270000-0x0000000000287000-memory.dmpFilesize
92KB
-
memory/1384-70-0x0000000000250000-0x0000000000267000-memory.dmpFilesize
92KB
-
memory/1384-69-0x0000000076AE1000-0x0000000076AE3000-memory.dmpFilesize
8KB
-
memory/1384-67-0x0000000000250000-0x0000000000267000-memory.dmpFilesize
92KB
-
memory/1500-81-0x00000000003C0000-0x00000000003D7000-memory.dmpFilesize
92KB
-
memory/1500-77-0x00000000003C0000-0x00000000003D7000-memory.dmpFilesize
92KB
-
memory/1500-88-0x00000000003A0000-0x00000000003B7000-memory.dmpFilesize
92KB
-
memory/1500-85-0x0000000000230000-0x0000000000240000-memory.dmpFilesize
64KB
-
memory/1500-84-0x00000000003A0000-0x00000000003B7000-memory.dmpFilesize
92KB
-
memory/1500-76-0x0000000000000000-mapping.dmp
-
memory/1668-54-0x00000000002F0000-0x0000000000307000-memory.dmpFilesize
92KB
-
memory/1668-66-0x0000000000310000-0x0000000000320000-memory.dmpFilesize
64KB
-
memory/1668-58-0x00000000002F0000-0x0000000000307000-memory.dmpFilesize
92KB
-
memory/1668-65-0x0000000000250000-0x0000000000267000-memory.dmpFilesize
92KB
-
memory/1920-82-0x0000000000320000-0x0000000000337000-memory.dmpFilesize
92KB
-
memory/1920-83-0x0000000000340000-0x0000000000350000-memory.dmpFilesize
64KB
-
memory/1920-75-0x00000000003D0000-0x00000000003E7000-memory.dmpFilesize
92KB
-
memory/1920-71-0x00000000003D0000-0x00000000003E7000-memory.dmpFilesize
92KB