58b5c71cb21b0c9327216aff93feed72365921d396e21eab0f2413a84fdd833f

Analysis

max time kernel
151s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

W3.class
Size

924B
MD5

b6e85e40b43ef3bbcece2b904ab21a1f
SHA1

0539cc7999df46f2f8a6266b36d30de3c3ffb534
SHA256

03e8527d54ea48e42423bec4b5b450a83e98ee455dbec633dc05ffdab2ee87ce
SHA512

ce3e2d0e546b363b791c7636a66ec8b9657614685352c05008efb158940562158ced143df6b1cdc88da6907849ff5cd8b4c60aad256265e91577b2363a0579f4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.class	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
600	AcroRd32.exe
600	AcroRd32.exe
600	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1424	1052	cmd.exe	29
PID 1052 wrote to memory of 1424	1052	cmd.exe	29
PID 1052 wrote to memory of 1424	1052	cmd.exe	29
PID 1424 wrote to memory of 600	1424	rundll32.exe	30
PID 1424 wrote to memory of 600	1424	rundll32.exe	30
PID 1424 wrote to memory of 600	1424	rundll32.exe	30
PID 1424 wrote to memory of 600	1424	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\W3.class
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\W3.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\W3.class"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/600-82-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1052-54-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmp

Filesize
8KB

Download