Analysis
-
max time kernel
153s -
max time network
128s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-01-2022 01:50
Behavioral task
behavioral1
Sample
UnHAnaAW.x86
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
UnHAnaAW.x86
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
UnHAnaAW.x86
-
Size
72KB
-
MD5
2fbd7450e710106e40f973c15359d94a
-
SHA1
981cf3e75f770741b2c8287fd080e0bdd31b17f2
-
SHA256
f28f21fb731b222ba26788a21c5d8f9547c55e3a1703204fb634c7cdf12f75b4
-
SHA512
5098684ea0b96cd2e663374b7eee3fdece6170c6eca0edecd7e11f17eb198cd97191c572a8e8aeb0876cc8a99ce45962ee82d55ab5baa5ea3cf78a5beecf76e8
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 10 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\x86_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\x86_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\.x86\ = "x86_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\x86_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\x86_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\x86_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\x86_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\.x86 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 776 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 776 AcroRd32.exe 776 AcroRd32.exe 776 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1744 wrote to memory of 864 1744 cmd.exe rundll32.exe PID 1744 wrote to memory of 864 1744 cmd.exe rundll32.exe PID 1744 wrote to memory of 864 1744 cmd.exe rundll32.exe PID 864 wrote to memory of 776 864 rundll32.exe AcroRd32.exe PID 864 wrote to memory of 776 864 rundll32.exe AcroRd32.exe PID 864 wrote to memory of 776 864 rundll32.exe AcroRd32.exe PID 864 wrote to memory of 776 864 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\UnHAnaAW.x861⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\UnHAnaAW.x862⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\UnHAnaAW.x86"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx