Analysis

  • max time kernel
    151s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2022, 23:22 UTC

General

  • Target

    CodeS.class

  • Size

    1KB

  • MD5

    c07d9fe8031e1958710b786bee20955e

  • SHA1

    0d61e29d19e2cd4270774790b47f9dfb374a7446

  • SHA256

    9f000e53ee1979999d11843d3ebeb7fc039d5766c2b9245f3996e71eb43a0c2c

  • SHA512

    66c3ef446a9652ac836c888405b7361228d76397a51ba27de72b2f63a66b32d15e64bdb01df62d86417b39a8d34b3ba39477892b1a62449cb56096c6823ea13d

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 10 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\CodeS.class
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1012
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CodeS.class
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CodeS.class"
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:584

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/584-82-0x00000000763F1000-0x00000000763F3000-memory.dmp

    Filesize

    8KB

  • memory/1012-54-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

    Filesize

    8KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.