Overview
overview
7Static
static
7a/A.class
windows7-x64
3a/A.class
windows10-2004-x64
3a/B.class
windows7-x64
3a/B.class
windows10-2004-x64
1a/C.class
windows7-x64
3a/C.class
windows10-2004-x64
1a/D.class
windows7-x64
3a/D.class
windows10-2004-x64
1a/E.class
windows7-x64
3a/E.class
windows10-2004-x64
3a/F.class
windows7-x64
3a/F.class
windows10-2004-x64
3a/G.class
windows7-x64
3a/G.class
windows10-2004-x64
1a/H.class
windows7-x64
3a/H.class
windows10-2004-x64
1a/I.class
windows7-x64
3a/I.class
windows10-2004-x64
3a/J.class
windows7-x64
3a/J.class
windows10-2004-x64
1a/K.class
windows7-x64
3a/K.class
windows10-2004-x64
1a/L.class
windows7-x64
3a/L.class
windows10-2004-x64
1a/M.class
windows7-x64
3a/M.class
windows10-2004-x64
1a/N.class
windows7-x64
3a/N.class
windows10-2004-x64
3a/O.class
windows7-x64
3a/O.class
windows10-2004-x64
3a/P.class
windows7-x64
3a/P.class
windows10-2004-x64
1Analysis
-
max time kernel
103s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 00:38
Behavioral task
behavioral1
Sample
a/A.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
a/A.class
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
a/B.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
a/B.class
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
a/C.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
a/C.class
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
a/D.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral8
Sample
a/D.class
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
a/E.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral10
Sample
a/E.class
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
a/F.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral12
Sample
a/F.class
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
a/G.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral14
Sample
a/G.class
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
a/H.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral16
Sample
a/H.class
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
a/I.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral18
Sample
a/I.class
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
a/J.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral20
Sample
a/J.class
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
a/K.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral22
Sample
a/K.class
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
a/L.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral24
Sample
a/L.class
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
a/M.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral26
Sample
a/M.class
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
a/N.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral28
Sample
a/N.class
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
a/O.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral30
Sample
a/O.class
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
a/P.class
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral32
Sample
a/P.class
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
a/F.class
-
Size
10KB
-
MD5
1cd31f67b6eff531c2d95bb0e174c1e5
-
SHA1
39df1f73df968ea4d50de3d56b6b2f474187abd2
-
SHA256
962b91f47d2094c2c6c496acc3cd197022ad997a0066992783603d35a959ec1b
-
SHA512
704ff6ab965f4a90c23203d319e2f9c0c643c7b810cc2be1a5b1c7c4173c458a8161ea8ce5abcfb106c8bf56bc304ad90ce01059f83742c9b3484f382f773e06
-
SSDEEP
192:Nkx1TRLrggzdor0pGlnQl/NRAW+ndFqyPhSCH6o:NaTLrgUdor0pGqNCLhJz
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2892 OpenWith.exe -
Suspicious use of SetWindowsHookEx 37 IoCs
pid Process 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 2892 OpenWith.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 4760 2892 OpenWith.exe 94 PID 2892 wrote to memory of 4760 2892 OpenWith.exe 94 PID 2892 wrote to memory of 4760 2892 OpenWith.exe 94 PID 4760 wrote to memory of 3948 4760 AcroRd32.exe 96 PID 4760 wrote to memory of 3948 4760 AcroRd32.exe 96 PID 4760 wrote to memory of 3948 4760 AcroRd32.exe 96 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 2528 3948 RdrCEF.exe 97 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98 PID 3948 wrote to memory of 4880 3948 RdrCEF.exe 98
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\a\F.class1⤵
- Modifies registry class
PID:648
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a\F.class"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B8E00656F94344E1B65EBB169F4F9B86 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2528
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AC9A9ADC3591E099E378FBC390835FD4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AC9A9ADC3591E099E378FBC390835FD4 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:14⤵PID:4880
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FDE2EEE96D7255454B62CFB5738BACA5 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:780
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=63C63BBAEED8D7BABA50DA48791DF2BC --mojo-platform-channel-handle=1932 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3672
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1DA1B64D4A694EAE4DF541907CF7B878 --mojo-platform-channel-handle=2492 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:4740
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4280