Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 18:20
Behavioral task
behavioral1
Sample
65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe
Resource
win7-20220901-en
General
-
Target
65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe
-
Size
183KB
-
MD5
f4dc998378cca164858034502f44184e
-
SHA1
c43c533b862a47fa33a972dfe8e9acaf4de33648
-
SHA256
65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92
-
SHA512
e982319094ed6020015d4978ff494b3bcf85d60346eee19e24b30a749d29484a515a37285d59b7fa32fe069997a2ac0b7df28b626f5070b5e74e2ea0bd5113f9
-
SSDEEP
3072:OA+PrAn3UAwpBFPbSbl8ZVcuGdrpWoWxiKJOXx2Q0mIOH0ZGvfdONt7T0Wf6B567:SME7pTOMkJqiK4Bft3MNZUPWrX
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
reswwcs.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat reswwcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
reswwcs.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-b6-4f-0d-b5-68\WpadDecisionReason = "1" reswwcs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-b6-4f-0d-b5-68\WpadDecisionTime = f0d7aa650e34d901 reswwcs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings reswwcs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections reswwcs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix reswwcs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 reswwcs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad reswwcs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DEBB7726-33BA-4A4E-8498-E682477C1101}\WpadDecision = "0" reswwcs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 reswwcs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" reswwcs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings reswwcs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 reswwcs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DEBB7726-33BA-4A4E-8498-E682477C1101}\WpadNetworkName = "Network 2" reswwcs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DEBB7726-33BA-4A4E-8498-E682477C1101}\d6-b6-4f-0d-b5-68 reswwcs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" reswwcs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DEBB7726-33BA-4A4E-8498-E682477C1101} reswwcs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DEBB7726-33BA-4A4E-8498-E682477C1101}\WpadDecisionTime = f0d7aa650e34d901 reswwcs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-b6-4f-0d-b5-68\WpadDecision = "0" reswwcs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" reswwcs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DEBB7726-33BA-4A4E-8498-E682477C1101}\WpadDecisionReason = "1" reswwcs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-b6-4f-0d-b5-68 reswwcs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
reswwcs.exepid process 1620 reswwcs.exe 1620 reswwcs.exe 1620 reswwcs.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exepid process 1540 65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exereswwcs.exereswwcs.exepid process 1724 65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe 1540 65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe 1704 reswwcs.exe 1620 reswwcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exereswwcs.exedescription pid process target process PID 1724 wrote to memory of 1540 1724 65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe 65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe PID 1724 wrote to memory of 1540 1724 65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe 65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe PID 1724 wrote to memory of 1540 1724 65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe 65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe PID 1724 wrote to memory of 1540 1724 65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe 65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe PID 1704 wrote to memory of 1620 1704 reswwcs.exe reswwcs.exe PID 1704 wrote to memory of 1620 1704 reswwcs.exe reswwcs.exe PID 1704 wrote to memory of 1620 1704 reswwcs.exe reswwcs.exe PID 1704 wrote to memory of 1620 1704 reswwcs.exe reswwcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe"C:\Users\Admin\AppData\Local\Temp\65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\65ec01b7af862c39ac4e783283a015537810c61a065b913f11cc46db993c4e92.exe--d2c1114b2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\reswwcs.exe"C:\Windows\SysWOW64\reswwcs.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reswwcs.exe--91c16062⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1540-55-0x0000000000000000-mapping.dmp
-
memory/1540-59-0x0000000000220000-0x000000000023B000-memory.dmpFilesize
108KB
-
memory/1540-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1540-64-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1620-62-0x0000000000000000-mapping.dmp
-
memory/1620-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1620-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1724-54-0x0000000075111000-0x0000000075113000-memory.dmpFilesize
8KB
-
memory/1724-56-0x00000000001B0000-0x00000000001CB000-memory.dmpFilesize
108KB
-
memory/1724-58-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB