d03deb4f97ee45ec9651dc5d54db8ca523dc4307521cae3f88b966fa9bc29096

Analysis

max time kernel
150s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-11-2022 04:23

Target

916c7b0264d6120982665ec43461f326.dex
Size

10KB
MD5

916c7b0264d6120982665ec43461f326
SHA1

43b52d2ea898aa715a0f158e6cc3da45f950c5d8
SHA256

d03deb4f97ee45ec9651dc5d54db8ca523dc4307521cae3f88b966fa9bc29096
SHA512

ddae3991cd4754d4baecd7f12905b7ea478434020e5bf583422a3f2799553f040ea16facd0d1b598277294bec4bbbd3c165311dceaed079e126a2381cb3f0635
SSDEEP

192:4Xsr6tRtn2tylD6C9Q9Mib6tTo16/wjUFjAqJrEaYq/4rUbqM9xd:ZrItn2S6fEFxRAErEaY0Fbqq

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\dex_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.dex\ = "dex_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\dex_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\dex_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\dex_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\dex_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.dex	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\dex_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1792 AcroRd32.exe
1792 AcroRd32.exe
1792 AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1980 wrote to memory of 1264	1980	cmd.exe	rundll32.exe
PID 1980 wrote to memory of 1264	1980	cmd.exe	rundll32.exe
PID 1980 wrote to memory of 1264	1980	cmd.exe	rundll32.exe
PID 1264 wrote to memory of 1792	1264	rundll32.exe	AcroRd32.exe
PID 1264 wrote to memory of 1792	1264	rundll32.exe	AcroRd32.exe
PID 1264 wrote to memory of 1792	1264	rundll32.exe	AcroRd32.exe
PID 1264 wrote to memory of 1792	1264	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\916c7b0264d6120982665ec43461f326.dex
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\916c7b0264d6120982665ec43461f326.dex
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\916c7b0264d6120982665ec43461f326.dex"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1792

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1264-76-0x0000000000000000-mapping.dmp

Download
memory/1792-81-0x0000000000000000-mapping.dmp

Download
memory/1792-82-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1980-54-0x000007FEFB831000-0x000007FEFB833000-memory.dmp

Filesize
8KB

Download