ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade

Analysis

max time kernel
40s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Size

85KB
MD5

0472ac97a627d6dd37efda055a196e67
SHA1

6ae8891d590823ca335c04a13a6fb9ced7bbe545
SHA256

ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade
SHA512

bbb6da0ac02feeb6df665d56118fd06ac88059e115420236e171aa4ab929ecdf6202d064fdf87f7690707d1994613a330808695597f1fb01bb8be3f92e98bf02
SSDEEP

768:f/pxutRDjgrRm8gBywbpXJYRuKJ9h7Nqg04l91B0EAGBrIvUsxIhzX2EAuPjQMeE:sWRVUygH4l91B05GBKI7AubTeyqTPEJ

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cmd.exe	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1812 set thread context of 868	1812	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 42 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\ = "_Class1"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\ = "Class1"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{63A01C49-CD5B-4273-9076-7E8800C136BE}	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{63A01C49-CD5B-4273-9076-7E8800C136BE}\1.0	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{63A01C49-CD5B-4273-9076-7E8800C136BE}\1.0\FLAGS\ = "0"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\TypeLib	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{63A01C49-CD5B-4273-9076-7E8800C136BE}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EB3A1EA-5514-4240-936F-CC8A763086F2}	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\ProxyStubClsid	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\ProxyStubClsid32	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\TypeLib	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\TypeLib\ = "{63A01C49-CD5B-4273-9076-7E8800C136BE}"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\TypeLib\Version = "1.0"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{63A01C49-CD5B-4273-9076-7E8800C136BE}\1.0\FLAGS	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{63A01C49-CD5B-4273-9076-7E8800C136BE}\1.0\0	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EB3A1EA-5514-4240-936F-CC8A763086F2}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\ = "_Class1"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EB3A1EA-5514-4240-936F-CC8A763086F2}\ = "Proyecto1.Class1"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EB3A1EA-5514-4240-936F-CC8A763086F2}\VERSION\ = "1.0"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{63A01C49-CD5B-4273-9076-7E8800C136BE}\1.0\HELPDIR	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\TypeLib\ = "{63A01C49-CD5B-4273-9076-7E8800C136BE}"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EB3A1EA-5514-4240-936F-CC8A763086F2}\TypeLib\ = "{63A01C49-CD5B-4273-9076-7E8800C136BE}"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EB3A1EA-5514-4240-936F-CC8A763086F2}\VERSION	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{63A01C49-CD5B-4273-9076-7E8800C136BE}\1.0\0\win32	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EB3A1EA-5514-4240-936F-CC8A763086F2}\TypeLib	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EB3A1EA-5514-4240-936F-CC8A763086F2}\Implemented Categories	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Proyecto1.Class1	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Proyecto1.Class1\ = "Proyecto1.Class1"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Proyecto1.Class1\Clsid	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Proyecto1.Class1\Clsid\ = "{8EB3A1EA-5514-4240-936F-CC8A763086F2}"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{63A01C49-CD5B-4273-9076-7E8800C136BE}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\TypeLib\Version = "1.0"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EB3A1EA-5514-4240-936F-CC8A763086F2}\ProgID	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EB3A1EA-5514-4240-936F-CC8A763086F2}\ProgID\ = "Proyecto1.Class1"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{63A01C49-CD5B-4273-9076-7E8800C136BE}\1.0\ = "Proyecto1"	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA126805-51DE-42CC-BC91-18EE331DD9CF}\ProxyStubClsid32	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EB3A1EA-5514-4240-936F-CC8A763086F2}\Programmable	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1812	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
868	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 868	1812	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe	28
PID 1812 wrote to memory of 868	1812	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe	28
PID 1812 wrote to memory of 868	1812	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe	28
PID 1812 wrote to memory of 868	1812	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe	28
PID 1812 wrote to memory of 868	1812	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe	28
PID 1812 wrote to memory of 868	1812	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe	28
PID 1812 wrote to memory of 868	1812	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe	28
PID 1812 wrote to memory of 868	1812	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe	28
PID 1812 wrote to memory of 868	1812	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe	28
PID 868 wrote to memory of 1704	868	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe	31
PID 868 wrote to memory of 1704	868	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe	31
PID 868 wrote to memory of 1704	868	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe	31
PID 868 wrote to memory of 1704	868	ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe	31

C:\Users\Admin\AppData\Local\Temp\ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
"C:\Users\Admin\AppData\Local\Temp\ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Temp\ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe
  "C:\Users\Admin\AppData\Local\Temp\ad6353969edc3babdec35111fb833434fc6da37d374bf78b61245bca287bfade.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:1704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-63-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/868-72-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/868-70-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/868-69-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/1812-58-0x00000000002B0000-0x00000000002C0000-memory.dmp

Filesize
64KB

Download
memory/1812-62-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/1812-59-0x00000000002C0000-0x00000000002D0000-memory.dmp

Filesize
64KB

Download
memory/1812-60-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/1812-61-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/1812-66-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1812-55-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/1812-57-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download
memory/1812-56-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/1812-54-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download