Analysis
-
max time kernel
134s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 18:21
Behavioral task
behavioral1
Sample
57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe
Resource
win7-20221111-en
General
-
Target
57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe
-
Size
183KB
-
MD5
18df18cfc2c881ff5848253ef7b9a79b
-
SHA1
b2306421993de31e7387889bf9963c1fcee5c199
-
SHA256
57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6
-
SHA512
20a666e29cb84a0eb7fbf986c68200664b7146b32c0fd9f72f51c7e6951df4870b185ac8f8a265c46bb5e6816b9f9c75890d1ad6036568690d0287b7c0ce2375
-
SSDEEP
3072:RV+PrAn3UAwpBFPbSbl8ZVcuGdrpWoWxiKJOXx2Q0mIOH0ZPvfdONt7T0Wf6B56j:QME7pTOMkJqiK4Bfc3MNZUPWrFt
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
earconwab.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat earconwab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
earconwab.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FDF681B8-24C7-4E55-9046-F4F90D53752E} earconwab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings earconwab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections earconwab.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" earconwab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings earconwab.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" earconwab.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f004b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earconwab.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earconwab.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix earconwab.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FDF681B8-24C7-4E55-9046-F4F90D53752E}\WpadDecisionTime = 50e5920c1734d901 earconwab.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FDF681B8-24C7-4E55-9046-F4F90D53752E}\WpadNetworkName = "Network 2" earconwab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-2a-05-cd-76-57 earconwab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FDF681B8-24C7-4E55-9046-F4F90D53752E}\2a-2a-05-cd-76-57 earconwab.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" earconwab.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 earconwab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad earconwab.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FDF681B8-24C7-4E55-9046-F4F90D53752E}\WpadDecisionReason = "1" earconwab.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FDF681B8-24C7-4E55-9046-F4F90D53752E}\WpadDecision = "0" earconwab.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-2a-05-cd-76-57\WpadDecision = "0" earconwab.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-2a-05-cd-76-57\WpadDecisionReason = "1" earconwab.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-2a-05-cd-76-57\WpadDecisionTime = 50e5920c1734d901 earconwab.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
earconwab.exepid process 584 earconwab.exe 584 earconwab.exe 584 earconwab.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exepid process 1400 57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exeearconwab.exeearconwab.exepid process 1544 57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe 1400 57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe 664 earconwab.exe 584 earconwab.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exeearconwab.exedescription pid process target process PID 1544 wrote to memory of 1400 1544 57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe 57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe PID 1544 wrote to memory of 1400 1544 57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe 57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe PID 1544 wrote to memory of 1400 1544 57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe 57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe PID 1544 wrote to memory of 1400 1544 57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe 57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe PID 664 wrote to memory of 584 664 earconwab.exe earconwab.exe PID 664 wrote to memory of 584 664 earconwab.exe earconwab.exe PID 664 wrote to memory of 584 664 earconwab.exe earconwab.exe PID 664 wrote to memory of 584 664 earconwab.exe earconwab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe"C:\Users\Admin\AppData\Local\Temp\57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\57345e46232e31ba46f2f1392f23af8406877a39b1161f64ee92d9c42703f5b6.exe--883e77452⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\earconwab.exe"C:\Windows\SysWOW64\earconwab.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\earconwab.exe--28e02b022⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/584-62-0x0000000000000000-mapping.dmp
-
memory/584-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/584-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1400-55-0x0000000000000000-mapping.dmp
-
memory/1400-59-0x00000000003C0000-0x00000000003DB000-memory.dmpFilesize
108KB
-
memory/1400-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1400-64-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1544-54-0x00000000764C1000-0x00000000764C3000-memory.dmpFilesize
8KB
-
memory/1544-57-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1544-56-0x0000000000220000-0x000000000023B000-memory.dmpFilesize
108KB