aefeed0c32afb5933a44c85ba14888058e58488053421c5fa86ffbe1bcf9efa8

Analysis

max time kernel
34s
max time network
43s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-06-2022 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2022-06-16-extic.icu-empower-type.tiff.bin
Size

205KB
MD5

314a641ee6ef932f4c561388bd539090
SHA1

f20a688766f3c7105b64a6342277879d751de6f3
SHA256

1e9aaf1375d9f7403644b4bea2c6fe679579bf61945ba6bdb54cc7cd7b728211
SHA512

2f6c34bf7bd616a5c5c5fbaefd1fe066a55af17cf599dd4cf2bc0d7185a0557ca38833f2ddbc58d32aa8a9ede2635ce4ffadb49e3f726e7d9ce080c2d1961d5d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\bin_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\.bin	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\bin_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\bin_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\.bin\ = "bin_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\bin_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\bin_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
568	AcroRd32.exe
568	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1740	1728	cmd.exe	28
PID 1728 wrote to memory of 1740	1728	cmd.exe	28
PID 1728 wrote to memory of 1740	1728	cmd.exe	28
PID 1740 wrote to memory of 568	1740	rundll32.exe	29
PID 1740 wrote to memory of 568	1740	rundll32.exe	29
PID 1740 wrote to memory of 568	1740	rundll32.exe	29
PID 1740 wrote to memory of 568	1740	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2022-06-16-extic.icu-empower-type.tiff.bin
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\2022-06-16-extic.icu-empower-type.tiff.bin
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2022-06-16-extic.icu-empower-type.tiff.bin"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-82-0x0000000075381000-0x0000000075383000-memory.dmp

Filesize
8KB

Download
memory/1728-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

Filesize
8KB

Download