45c944889a482ae2e0e0a8e260c3be737cb612c8804164badef61e8a8713b92f

Analysis

max time kernel
150s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-09-2022 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RasTls.dll.res
Size

136KB
MD5

9ae8a7837c60f3f587701934ff41bd96
SHA1

ea7595bff1cfd1d72fe72417bf263d9adc9bc59e
SHA256

37b3fb9aa12277f355bbb334c82b41e4155836cf3a1b83e543ce53da9d429e2f
SHA512

61ba5240b9a2376f8c88616b229323f71775639d1629467847260d555251b5d9b9e36a7858d8ff1601e3661163020219c2b3192997acd323bf58b27f8ed2efe2
SSDEEP

3072:ksc0lGgJJtaJXdlVVnXSRRABY3GNCQA1tRnB/rnWADLNBd61H3f9SWv5:k/0JJJtaJXdlVVnCXuCXtRnB/SAViHsi

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\res_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\res_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\res_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\res_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\res_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.res	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.res\ = "res_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\res_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

1292 AcroRd32.exe
1292 AcroRd32.exe

pid	process
1292	AcroRd32.exe
1292	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1988 wrote to memory of 1372	1988	cmd.exe	rundll32.exe
PID 1988 wrote to memory of 1372	1988	cmd.exe	rundll32.exe
PID 1988 wrote to memory of 1372	1988	cmd.exe	rundll32.exe
PID 1372 wrote to memory of 1292	1372	rundll32.exe	AcroRd32.exe
PID 1372 wrote to memory of 1292	1372	rundll32.exe	AcroRd32.exe
PID 1372 wrote to memory of 1292	1372	rundll32.exe	AcroRd32.exe
PID 1372 wrote to memory of 1292	1372	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RasTls.dll.res
1⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RasTls.dll.res
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1372

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RasTls.dll.res"
3⤵
- Suspicious use of SetWindowsHookEx
PID:1292

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-81-0x0000000000000000-mapping.dmp

Download
memory/1292-82-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1372-76-0x0000000000000000-mapping.dmp

Download
memory/1988-54-0x000007FEFBF41000-0x000007FEFBF43000-memory.dmp

Filesize
8KB

Download