d312c079c51f2bf011902df86e1ca4cac84eb7c74ff104fa48a505caa88ef2fe

Analysis

max time kernel
154s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

challenge-files/challenge-files/infection-traffic.pcap
Size

3.9MB
MD5

c7fcd889649eb0229620b2cc0fba5add
SHA1

ab507bd070f99a3bce726176b37b1fb7d907d97c
SHA256

14c26cf8ded22562b9d0f5d2923f20e27515dbedc25c97976889927d598ee262
SHA512

a3ad9b15de43141d0fcf2cacceccdb70ed4b430330c769d630ccdf4780a936222c20a1ac6a94a6610a26b13a9d5421222ef2a9f751332146db569c72ab646016
SSDEEP

49152:FHLP2dei6dBNQvmmnUOTJA/avOYTsGKHTDy8Fr6HHTWVdiiUoornjvO59P1lgREH:oI5alUEa/wOIsG0e8IHHpooVREJS7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\pcap_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.pcap\ = "pcap_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\pcap_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\pcap_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\pcap_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.pcap	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\pcap_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\pcap_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1096 AcroRd32.exe
1096 AcroRd32.exe
1096 AcroRd32.exe

pid	process
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1992 wrote to memory of 1336	1992	cmd.exe	rundll32.exe
PID 1992 wrote to memory of 1336	1992	cmd.exe	rundll32.exe
PID 1992 wrote to memory of 1336	1992	cmd.exe	rundll32.exe
PID 1336 wrote to memory of 1096	1336	rundll32.exe	AcroRd32.exe
PID 1336 wrote to memory of 1096	1336	rundll32.exe	AcroRd32.exe
PID 1336 wrote to memory of 1096	1336	rundll32.exe	AcroRd32.exe
PID 1336 wrote to memory of 1096	1336	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\challenge-files\challenge-files\infection-traffic.pcap
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\challenge-files\challenge-files\infection-traffic.pcap
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1336

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\challenge-files\challenge-files\infection-traffic.pcap"
3⤵
- Suspicious use of SetWindowsHookEx
PID:1096

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-81-0x0000000000000000-mapping.dmp

Download
memory/1096-82-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1336-76-0x0000000000000000-mapping.dmp

Download
memory/1992-54-0x000007FEFBE81000-0x000007FEFBE83000-memory.dmp

Filesize
8KB

Download