Analysis
-
max time kernel
164s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 18:03
Static task
static1
Behavioral task
behavioral1
Sample
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe
Resource
win7-20220812-en
7 signatures
150 seconds
General
-
Target
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe
-
Size
244KB
-
MD5
73a62d9879926cc9e6d46a172c8c7ee6
-
SHA1
4f748aa60caf62469492856a99053514b65b1e94
-
SHA256
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3
-
SHA512
f2aace748be4dc1f330abce4f4a65ee1f29242a49b3759469304a28ca379f989c215da6a94ee2a2f234c6cc76629e5dcd23e8f137e905a2713ff73c2e9b6b009
-
SSDEEP
6144:6b/t2ebYNZtTck5NIG69kA9EgD5j6xzD:o/tKRc0bkFEMjO
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat earcontuip.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings earcontuip.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\WpadDecisionTime = 20f7d4817e06d901 earcontuip.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\WpadDecision = "0" earcontuip.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\42-78-89-91-5a-76 earcontuip.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-78-89-91-5a-76\WpadDecisionReason = "1" earcontuip.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" earcontuip.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad earcontuip.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-78-89-91-5a-76 earcontuip.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\WpadNetworkName = "Network 2" earcontuip.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earcontuip.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB} earcontuip.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\WpadDecisionReason = "1" earcontuip.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earcontuip.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-78-89-91-5a-76\WpadDecisionTime = 20f7d4817e06d901 earcontuip.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-78-89-91-5a-76\WpadDecision = "0" earcontuip.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings earcontuip.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections earcontuip.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earcontuip.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 872 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe 1972 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe 852 earcontuip.exe 1256 earcontuip.exe 1256 earcontuip.exe 1256 earcontuip.exe 1256 earcontuip.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1972 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 872 wrote to memory of 1972 872 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe 28 PID 872 wrote to memory of 1972 872 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe 28 PID 872 wrote to memory of 1972 872 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe 28 PID 872 wrote to memory of 1972 872 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe 28 PID 852 wrote to memory of 1256 852 earcontuip.exe 30 PID 852 wrote to memory of 1256 852 earcontuip.exe 30 PID 852 wrote to memory of 1256 852 earcontuip.exe 30 PID 852 wrote to memory of 1256 852 earcontuip.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe"C:\Users\Admin\AppData\Local\Temp\f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe"C:\Users\Admin\AppData\Local\Temp\f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:1972
-
-
C:\Windows\SysWOW64\earcontuip.exe"C:\Windows\SysWOW64\earcontuip.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\earcontuip.exe"C:\Windows\SysWOW64\earcontuip.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1256
-