Overview

overview

10

Static

static

8

7z2201-x64.exe

windows10-2004-x64

10

Firefox_Se....4.exe

windows10-2004-x64

8

SumatraPDF...ll.exe

windows10-2004-x64

8

TB_Free_In...63.exe

windows10-2004-x64

8

XnView-511...ll.exe

windows10-2004-x64

9

avast_free...ne.exe

windows10-2004-x64

10

torbrowser...de.exe

windows10-2004-x64

8

vlc-3.0.17...64.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    213s
  • max time network
    233s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-de
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-delocale:de-deos:windows10-2004-x64systemwindows
  • submitted
    03-11-2022 16:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SumatraPDF-3.4-64-install.exe

  • Size

    7.1MB

  • MD5

    92cd610bc19dc7a462aa8ca52a8cf0cf

  • SHA1

    6f2c728a604efa75302097e66aebb91bbd828f82

  • SHA256

    1d24e11ea522c4bdbdb20b0f112fba5ceaa0e4eddf2227cf7310c8da4b123bbd

  • SHA512

    54afab5f75fbbd3289f5ea106dff53df3e0547e05b0c31474165b18433c268ff6ee8f111ea0baffdc85c4a63b27df0102db884a48c3af1d53c7ec87e90770417

  • SSDEEP

    196608:LTxCcXis/+6yoGetiKQPKV6I6YZvbr8AKXI:h7+6Bt+ParZvb/SI

Score
8/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SumatraPDF-3.4-64-install.exe
    "C:\Users\Admin\AppData\Local\Temp\SumatraPDF-3.4-64-install.exe"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4384
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\SumatraPDF\SumatraPDF.exe"
      2⤵
        PID:2916
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2308
      • C:\Users\Admin\AppData\Local\SumatraPDF\SumatraPDF.exe
        "C:\Users\Admin\AppData\Local\SumatraPDF\SumatraPDF.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:5048

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\SumatraPDF\SumatraPDF.exe
      Filesize

      7.1MB

      MD5

      92cd610bc19dc7a462aa8ca52a8cf0cf

      SHA1

      6f2c728a604efa75302097e66aebb91bbd828f82

      SHA256

      1d24e11ea522c4bdbdb20b0f112fba5ceaa0e4eddf2227cf7310c8da4b123bbd

      SHA512

      54afab5f75fbbd3289f5ea106dff53df3e0547e05b0c31474165b18433c268ff6ee8f111ea0baffdc85c4a63b27df0102db884a48c3af1d53c7ec87e90770417

      Download Submit

    • C:\Users\Admin\AppData\Local\SumatraPDF\SumatraPDF.exe
      Filesize

      7.1MB

      MD5

      92cd610bc19dc7a462aa8ca52a8cf0cf

      SHA1

      6f2c728a604efa75302097e66aebb91bbd828f82

      SHA256

      1d24e11ea522c4bdbdb20b0f112fba5ceaa0e4eddf2227cf7310c8da4b123bbd

      SHA512

      54afab5f75fbbd3289f5ea106dff53df3e0547e05b0c31474165b18433c268ff6ee8f111ea0baffdc85c4a63b27df0102db884a48c3af1d53c7ec87e90770417

      Download Submit

    • C:\Users\Admin\AppData\Local\SumatraPDF\libmupdf.dll
      Filesize

      11.1MB

      MD5

      25e2080061c52a5dfeb7ed8e0ebc06a4

      SHA1

      29def96639dce75977729ca8e05f7a0ac9eb3af6

      SHA256

      2dde1f0d842a079853c771d558852f50367016d7f6ba53f5289a79225eca04ef

      SHA512

      2574000d2d7393633bb660acfc2b339b7ea701a1d88431414a27ab96589e280023ebf7dedcec7b9c5991624865524918f9fc9f221d4ebe6a37b729ee6f1b963f

      Download Submit

    • C:\Users\Admin\AppData\Local\SumatraPDF\libmupdf.dll
      Filesize

      11.1MB

      MD5

      25e2080061c52a5dfeb7ed8e0ebc06a4

      SHA1

      29def96639dce75977729ca8e05f7a0ac9eb3af6

      SHA256

      2dde1f0d842a079853c771d558852f50367016d7f6ba53f5289a79225eca04ef

      SHA512

      2574000d2d7393633bb660acfc2b339b7ea701a1d88431414a27ab96589e280023ebf7dedcec7b9c5991624865524918f9fc9f221d4ebe6a37b729ee6f1b963f

      Download Submit

    • memory/2916-132-0x0000000000000000-mapping.dmp

      Download

    • memory/5048-134-0x0000000000000000-mapping.dmp

      Download