1fce3f6211996da0e3be88ffda9d78eeedf0acf7b55fbe67c52fd5764845110d

Analysis

max time kernel
187s
max time network
65s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-07-2022 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data/java/metasploit/Payload.class
Size

8KB
MD5

df67ee317a6aecfdd989bc3a4a66aec2
SHA1

4e6c35d65a0b922154a482e1784d3be83390c288
SHA256

93599b9c8d54a2198a10d4fe9b771515cc805fd1d0fd991d8c9a454d5c570f3a
SHA512

c52a5644fcd5ee343bbf8a59954f0ee26e23567e089b07a5c06e0815812fdd08030cfa006f717a865743ac0d4d4bbae065cdba806966e7bc1c5e6941d1ebfd71

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\class_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\class_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\.class	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\class_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1716 AcroRd32.exe
1716 AcroRd32.exe
1716 AcroRd32.exe

pid	process
1716	AcroRd32.exe
1716	AcroRd32.exe
1716	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1464 wrote to memory of 916	1464	cmd.exe	rundll32.exe
PID 1464 wrote to memory of 916	1464	cmd.exe	rundll32.exe
PID 1464 wrote to memory of 916	1464	cmd.exe	rundll32.exe
PID 916 wrote to memory of 1716	916	rundll32.exe	AcroRd32.exe
PID 916 wrote to memory of 1716	916	rundll32.exe	AcroRd32.exe
PID 916 wrote to memory of 1716	916	rundll32.exe	AcroRd32.exe
PID 916 wrote to memory of 1716	916	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data\java\metasploit\Payload.class
1⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\data\java\metasploit\Payload.class
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:916

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\data\java\metasploit\Payload.class"
3⤵
- Suspicious use of SetWindowsHookEx
PID:1716

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-76-0x0000000000000000-mapping.dmp

Download
memory/1464-54-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmp

Filesize
8KB

Download
memory/1716-81-0x0000000000000000-mapping.dmp

Download
memory/1716-82-0x0000000076721000-0x0000000076723000-memory.dmp

Filesize
8KB

Download