Analysis
-
max time kernel
164s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 18:03
Static task
static1
Behavioral task
behavioral1
Sample
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe
Resource
win7-20220812-en
General
-
Target
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe
-
Size
244KB
-
MD5
73a62d9879926cc9e6d46a172c8c7ee6
-
SHA1
4f748aa60caf62469492856a99053514b65b1e94
-
SHA256
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3
-
SHA512
f2aace748be4dc1f330abce4f4a65ee1f29242a49b3759469304a28ca379f989c215da6a94ee2a2f234c6cc76629e5dcd23e8f137e905a2713ff73c2e9b6b009
-
SSDEEP
6144:6b/t2ebYNZtTck5NIG69kA9EgD5j6xzD:o/tKRc0bkFEMjO
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
earcontuip.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat earcontuip.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 18 IoCs
Processes:
earcontuip.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings earcontuip.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\WpadDecisionTime = 20f7d4817e06d901 earcontuip.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\WpadDecision = "0" earcontuip.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\42-78-89-91-5a-76 earcontuip.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-78-89-91-5a-76\WpadDecisionReason = "1" earcontuip.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" earcontuip.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad earcontuip.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-78-89-91-5a-76 earcontuip.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\WpadNetworkName = "Network 2" earcontuip.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earcontuip.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB} earcontuip.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\WpadDecisionReason = "1" earcontuip.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earcontuip.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-78-89-91-5a-76\WpadDecisionTime = 20f7d4817e06d901 earcontuip.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-78-89-91-5a-76\WpadDecision = "0" earcontuip.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings earcontuip.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections earcontuip.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earcontuip.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exef73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exeearcontuip.exeearcontuip.exepid process 872 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe 1972 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe 852 earcontuip.exe 1256 earcontuip.exe 1256 earcontuip.exe 1256 earcontuip.exe 1256 earcontuip.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exepid process 1972 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exeearcontuip.exedescription pid process target process PID 872 wrote to memory of 1972 872 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe PID 872 wrote to memory of 1972 872 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe PID 872 wrote to memory of 1972 872 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe PID 872 wrote to memory of 1972 872 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe PID 852 wrote to memory of 1256 852 earcontuip.exe earcontuip.exe PID 852 wrote to memory of 1256 852 earcontuip.exe earcontuip.exe PID 852 wrote to memory of 1256 852 earcontuip.exe earcontuip.exe PID 852 wrote to memory of 1256 852 earcontuip.exe earcontuip.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe"C:\Users\Admin\AppData\Local\Temp\f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe"C:\Users\Admin\AppData\Local\Temp\f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\earcontuip.exe"C:\Windows\SysWOW64\earcontuip.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\earcontuip.exe"C:\Windows\SysWOW64\earcontuip.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/852-84-0x0000000000340000-0x000000000035A000-memory.dmpFilesize
104KB
-
memory/852-76-0x0000000000360000-0x000000000037A000-memory.dmpFilesize
104KB
-
memory/852-72-0x0000000000360000-0x000000000037A000-memory.dmpFilesize
104KB
-
memory/852-85-0x0000000000320000-0x0000000000330000-memory.dmpFilesize
64KB
-
memory/872-67-0x00000000001E0000-0x00000000001FA000-memory.dmpFilesize
104KB
-
memory/872-54-0x0000000076181000-0x0000000076183000-memory.dmpFilesize
8KB
-
memory/872-55-0x0000000000280000-0x000000000029A000-memory.dmpFilesize
104KB
-
memory/872-68-0x00000000002A0000-0x00000000002B0000-memory.dmpFilesize
64KB
-
memory/872-59-0x0000000000280000-0x000000000029A000-memory.dmpFilesize
104KB
-
memory/1256-89-0x0000000000250000-0x000000000026A000-memory.dmpFilesize
104KB
-
memory/1256-88-0x0000000000310000-0x0000000000320000-memory.dmpFilesize
64KB
-
memory/1256-87-0x0000000000250000-0x000000000026A000-memory.dmpFilesize
104KB
-
memory/1256-77-0x0000000000000000-mapping.dmp
-
memory/1256-79-0x0000000000270000-0x000000000028A000-memory.dmpFilesize
104KB
-
memory/1256-83-0x0000000000270000-0x000000000028A000-memory.dmpFilesize
104KB
-
memory/1972-70-0x0000000000250000-0x0000000000260000-memory.dmpFilesize
64KB
-
memory/1972-60-0x0000000000000000-mapping.dmp
-
memory/1972-86-0x00000000002E0000-0x00000000002FA000-memory.dmpFilesize
104KB
-
memory/1972-62-0x0000000000300000-0x000000000031A000-memory.dmpFilesize
104KB
-
memory/1972-66-0x0000000000300000-0x000000000031A000-memory.dmpFilesize
104KB
-
memory/1972-69-0x00000000002E0000-0x00000000002FA000-memory.dmpFilesize
104KB