Analysis
-
max time kernel
158s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
10-08-2022 09:30
Static task
static1
Behavioral task
behavioral1
Sample
65d880c7f474720dafb84c1e93c51e11.zip
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
65d880c7f474720dafb84c1e93c51e11.zip
Resource
win10v2004-20220721-en
Behavioral task
behavioral3
Sample
Sorted-Algorithm.py
Resource
win7-20220715-en
Behavioral task
behavioral4
Sample
Sorted-Algorithm.py
Resource
win10v2004-20220721-en
General
-
Target
Sorted-Algorithm.py
-
Size
1KB
-
MD5
65d880c7f474720dafb84c1e93c51e11
-
SHA1
86072d208f6b2f20a890f54fe5acab5ee52f9ec4
-
SHA256
255392992bf103d218466399d670300453a69f24398b02f316a74826c1f95a82
-
SHA512
e701046c4b9dcd3718d0dca7d233bf5a9b9c344e86b60c0b2b6f355f6f794e11e716f13cd306befc2f989114bf55b22f3f1da711010b53e0431c217243665878
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 10 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\py_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\.py rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 280 AcroRd32.exe 280 AcroRd32.exe 280 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 532 wrote to memory of 1704 532 cmd.exe rundll32.exe PID 532 wrote to memory of 1704 532 cmd.exe rundll32.exe PID 532 wrote to memory of 1704 532 cmd.exe rundll32.exe PID 1704 wrote to memory of 280 1704 rundll32.exe AcroRd32.exe PID 1704 wrote to memory of 280 1704 rundll32.exe AcroRd32.exe PID 1704 wrote to memory of 280 1704 rundll32.exe AcroRd32.exe PID 1704 wrote to memory of 280 1704 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Sorted-Algorithm.py1⤵
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Sorted-Algorithm.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Sorted-Algorithm.py"3⤵
- Suspicious use of SetWindowsHookEx
PID:280