1fce3f6211996da0e3be88ffda9d78eeedf0acf7b55fbe67c52fd5764845110d

Analysis

max time kernel
189s
max time network
97s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-07-2022 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data/java/javapayload/stage/StreamForwarder.class
Size

1KB
MD5

14282f9002642627486bf322dda59410
SHA1

d258813bd351a77e5dc8d65dd665b94e3b5a822f
SHA256

76c8a99cdcecf9bfd1d4e03dd67fc0182271cb36d42cca93e31bb4ca5f5cc4d2
SHA512

661c7354790a1b6301dfccf4a52b7d76833dc09dc08ee8119387a194e19be4f7e2632af35ca329d08310dff7b7a5af6967b9355c3c8e20776472fef7d254b24e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\class_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\.class	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\class_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\class_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

820 AcroRd32.exe
820 AcroRd32.exe
820 AcroRd32.exe

pid	process
820	AcroRd32.exe
820	AcroRd32.exe
820	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1432 wrote to memory of 620	1432	cmd.exe	rundll32.exe
PID 1432 wrote to memory of 620	1432	cmd.exe	rundll32.exe
PID 1432 wrote to memory of 620	1432	cmd.exe	rundll32.exe
PID 620 wrote to memory of 820	620	rundll32.exe	AcroRd32.exe
PID 620 wrote to memory of 820	620	rundll32.exe	AcroRd32.exe
PID 620 wrote to memory of 820	620	rundll32.exe	AcroRd32.exe
PID 620 wrote to memory of 820	620	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data\java\javapayload\stage\StreamForwarder.class
1⤵
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\data\java\javapayload\stage\StreamForwarder.class
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:620

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\data\java\javapayload\stage\StreamForwarder.class"
3⤵
- Suspicious use of SetWindowsHookEx
PID:820

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-76-0x0000000000000000-mapping.dmp

Download
memory/820-81-0x0000000000000000-mapping.dmp

Download
memory/820-82-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1432-54-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Filesize
8KB

Download