b9df869f72e198d9767e5aa320be3691e6636ce33ee2148bdfd959cd89b48da1

Analysis

max time kernel
96s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
23-05-2022 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CashCat.exe
Size

518KB
MD5

e22f15441e597430b069dad9f72889fc
SHA1

6310f4db3726fdb52514718a402ede2db38c71bd
SHA256

fa6855733a1cca500f3088b535808fc8093d67cadc9b34ad4ca7ec0170b25e03
SHA512

b23e6c94b64cc18b42bbd6c95f07e335fb631fc8a003b01a64671e01067dbf8fa265cd4df30c6bfaca5ec61c068fa41d64b28b3c90bd88a1ee12ec13c7197469

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\CashCat.exe
"C:\Users\Admin\AppData\Local\Temp\CashCat.exe"
1⤵
PID:1760

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\UndoNew.i64
1⤵
- Modifies registry class
PID:1700

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-57-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

Filesize
8KB

Download
memory/1760-54-0x0000000000E20000-0x0000000000EA8000-memory.dmp

Filesize
544KB

Download
memory/1760-55-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/1760-56-0x0000000004DF5000-0x0000000004E06000-memory.dmp

Filesize
68KB

Download