Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 18:07
Behavioral task
behavioral1
Sample
e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe.exe
Resource
win7-20220901-en
General
-
Target
e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe.exe
-
Size
233KB
-
MD5
952b49b50ae9d59038ef8dfbf39cd151
-
SHA1
15453716ecb4407ef1169ca8ec3e91bdfa8dd39c
-
SHA256
e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe
-
SHA512
09995cd3ddf47107d5deae179fbec965450b4b6ada660ff572c568b9cb14a811c18424a97858908f0b0b65bde766507a491c89584b38139520c3e8b76e989d0c
-
SSDEEP
3072:XoGbF2ny0ViOfTOp3ORLYkGQXOa+8ZpDySU7fqMvVXAEuwkil0WtapmOgC9RPbkC:pMnyK/TTZEhvB0iIpVRPbkZ9rV4
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
Processes:
formeap.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 formeap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE formeap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies formeap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 formeap.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
formeap.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" formeap.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix formeap.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" formeap.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
formeap.exepid process 5080 formeap.exe 5080 formeap.exe 5080 formeap.exe 5080 formeap.exe 5080 formeap.exe 5080 formeap.exe 5080 formeap.exe 5080 formeap.exe 5080 formeap.exe 5080 formeap.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe.exepid process 2676 e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe.exeformeap.exedescription pid process target process PID 4664 wrote to memory of 2676 4664 e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe.exe e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe.exe PID 4664 wrote to memory of 2676 4664 e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe.exe e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe.exe PID 4664 wrote to memory of 2676 4664 e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe.exe e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe.exe PID 3500 wrote to memory of 5080 3500 formeap.exe formeap.exe PID 3500 wrote to memory of 5080 3500 formeap.exe formeap.exe PID 3500 wrote to memory of 5080 3500 formeap.exe formeap.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe.exe"C:\Users\Admin\AppData\Local\Temp\e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e1e2d3d72d616dc64773ad0490c11be022b0f48f54d06783b1144a0f50ac4dfe.exe--4fd58da62⤵
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\formeap.exe"C:\Windows\SysWOW64\formeap.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\formeap.exe--ee68b6662⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2676-133-0x0000000000000000-mapping.dmp
-
memory/2676-136-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2676-138-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/4664-132-0x0000000002180000-0x000000000219B000-memory.dmpFilesize
108KB
-
memory/4664-134-0x0000000002180000-0x000000000219B000-memory.dmpFilesize
108KB
-
memory/4664-135-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/5080-137-0x0000000000000000-mapping.dmp
-
memory/5080-139-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/5080-140-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB