ebe6daa7aab9ec166267a1180bb1cf92ed469184a61083526dd55d254a3af696

Analysis

max time kernel
123s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebe6daa7aab9ec166267a1180bb1cf92ed469184a61083526dd55d254a3af696.exe
Size

53KB
MD5

afcd13b2bb6133b95b16e6c3aa0d1a4c
SHA1

a08856531b59f0539eb3e943d97136606de7ad60
SHA256

ebe6daa7aab9ec166267a1180bb1cf92ed469184a61083526dd55d254a3af696
SHA512

48ec81a23872e836165d60ac8518eaea59f867602b47fb183ea896ff2e2c7c6c87479330c9ed1d51b3afec4b3b1d0ee3674e68e4e07f1ea4cb0d6ee3a298d828
SSDEEP

1536:01C2Zm/ruWYc/U26W+gJMgrZZ6EbQYlZhFinO7h:01C2Zm/ruWYc5+psbrGy

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1944	sweh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	ebe6daa7aab9ec166267a1180bb1cf92ed469184a61083526dd55d254a3af696.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sweh.exe	ebe6daa7aab9ec166267a1180bb1cf92ed469184a61083526dd55d254a3af696.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1944	3068	ebe6daa7aab9ec166267a1180bb1cf92ed469184a61083526dd55d254a3af696.exe	81
PID 3068 wrote to memory of 1944	3068	ebe6daa7aab9ec166267a1180bb1cf92ed469184a61083526dd55d254a3af696.exe	81
PID 3068 wrote to memory of 1944	3068	ebe6daa7aab9ec166267a1180bb1cf92ed469184a61083526dd55d254a3af696.exe	81

C:\Users\Admin\AppData\Local\Temp\ebe6daa7aab9ec166267a1180bb1cf92ed469184a61083526dd55d254a3af696.exe
"C:\Users\Admin\AppData\Local\Temp\ebe6daa7aab9ec166267a1180bb1cf92ed469184a61083526dd55d254a3af696.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\sweh.exe
  "C:\Windows\system32\sweh.exe"
  2⤵
  - Executes dropped EXE
  PID:1944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sweh.exe

Filesize
45KB

MD5
c3a2b8e2f133bbf5bed13ebad23cf0ca

SHA1
6bc8ef3b88b0f880f93573d13977d6050263947a

SHA256
5447e25d539e02a1411c0fac6cfec294d85be0453665ffb5b8ebd720fda2d9f1

SHA512
96956b47924d0497b1cd7890b28ee847dcded30d4f2c3351a7dcf96d829f50a509fe13ea405744e3eeb040b5ff20391a272bbcc35cd225c01cd2433d32400760

Download Submit
C:\Windows\SysWOW64\sweh.exe

Filesize
45KB

MD5
c3a2b8e2f133bbf5bed13ebad23cf0ca

SHA1
6bc8ef3b88b0f880f93573d13977d6050263947a

SHA256
5447e25d539e02a1411c0fac6cfec294d85be0453665ffb5b8ebd720fda2d9f1

SHA512
96956b47924d0497b1cd7890b28ee847dcded30d4f2c3351a7dcf96d829f50a509fe13ea405744e3eeb040b5ff20391a272bbcc35cd225c01cd2433d32400760

Download Submit
memory/1944-135-0x0000000000400000-0x000000000041B4E3-memory.dmp

Filesize
109KB

Download
memory/1944-136-0x0000000000400000-0x000000000041B4E3-memory.dmp

Filesize
109KB

Download
memory/1944-137-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download