cefae61756fd04a5a3c3fa18818220cb634f0ed9f205baed6eb223776d509cef

Analysis

max time kernel
20s
max time network
63s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cefae61756fd04a5a3c3fa18818220cb634f0ed9f205baed6eb223776d509cef.exe
Size

100KB
MD5

e9ebb89f9ab68eb2a7cdf4a83eac3404
SHA1

32173042cd9e465959187926ca5e4c0ff5c15a83
SHA256

cefae61756fd04a5a3c3fa18818220cb634f0ed9f205baed6eb223776d509cef
SHA512

0ab88fa5b0393637007f1ed3af929fe47ea7e5eb2dd159d57bbd54604af489c8ae6d18d06eb66272ddcec87b2170373784ac9cc4e95d84ea22862a1e13357ba2
SSDEEP

1536:2IlwXP+CmfyUZcCdgO0qcfFhLQAE5U3u4Re1FAdlMWoG3nQFe3WU/7p/N1/uXWI:RGXLVUiCWUcDLbX4wdHhnQXU1zmXWI

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cefae61756fd04a5a3c3fa18818220cb634f0ed9f205baed6eb223776d509cef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1472	ipconfig.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1952	cefae61756fd04a5a3c3fa18818220cb634f0ed9f205baed6eb223776d509cef.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1472	1952	cefae61756fd04a5a3c3fa18818220cb634f0ed9f205baed6eb223776d509cef.exe	28
PID 1952 wrote to memory of 1472	1952	cefae61756fd04a5a3c3fa18818220cb634f0ed9f205baed6eb223776d509cef.exe	28
PID 1952 wrote to memory of 1472	1952	cefae61756fd04a5a3c3fa18818220cb634f0ed9f205baed6eb223776d509cef.exe	28
PID 1952 wrote to memory of 1472	1952	cefae61756fd04a5a3c3fa18818220cb634f0ed9f205baed6eb223776d509cef.exe	28

C:\Users\Admin\AppData\Local\Temp\cefae61756fd04a5a3c3fa18818220cb634f0ed9f205baed6eb223776d509cef.exe
"C:\Users\Admin\AppData\Local\Temp\cefae61756fd04a5a3c3fa18818220cb634f0ed9f205baed6eb223776d509cef.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\system32\ipconfig.exe" /flushdns
  2⤵
  - Gathers network information
  PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-54-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/1952-57-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download