377d477d2942dac5b44137b7ac2a36e1588656598dc8b2b6402a80b7d7ee2502

Analysis

max time kernel
152s
max time network
43s
platform
windows7_x64
resource
win7-20220414-en
submitted
01/07/2022, 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

projectrequirements.rsp
Size

30B
MD5

6e020ce75c33224bce1d16a78a6c1eee
SHA1

fefc97b219e4e561bc6a2f4d81de3906a75fac5b
SHA256

3cfa1e65becda265b065294d9ecb9b5b79fe155fc9d456f9061e4a395f814a14
SHA512

dca95e0c296ac5112f5150521d2892c8e4cdad20ae7341b1d3bc454d5839d0c3b2a425a445dc69a357c8da9a217aa8a45b804f47cdcaff4eaa010c5b2ea16633

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\rsp_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\rsp_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\rsp_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\rsp_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\rsp_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\.rsp	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\.rsp\ = "rsp_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\rsp_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2028	AcroRd32.exe
2028	AcroRd32.exe
2028	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1140	1888	cmd.exe	27
PID 1888 wrote to memory of 1140	1888	cmd.exe	27
PID 1888 wrote to memory of 1140	1888	cmd.exe	27
PID 1140 wrote to memory of 2028	1140	rundll32.exe	28
PID 1140 wrote to memory of 2028	1140	rundll32.exe	28
PID 1140 wrote to memory of 2028	1140	rundll32.exe	28
PID 1140 wrote to memory of 2028	1140	rundll32.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\projectrequirements.rsp
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\projectrequirements.rsp
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\projectrequirements.rsp"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-54-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Filesize
8KB

Download
memory/2028-82-0x0000000075311000-0x0000000075313000-memory.dmp

Filesize
8KB

Download