Overview

overview

10

Static

static

8

7z2201-x64.exe

windows10-2004-x64

10

Firefox Se....4.exe

windows10-2004-x64

8

SumatraPDF...ll.exe

windows10-2004-x64

8

TB_Free_In...00.exe

windows10-2004-x64

8

XnViewMP-win-x64.exe

windows10-2004-x64

8

avast_one_...us.exe

windows10-2004-x64

10

torbrowser...US.exe

windows10-2004-x64

8

vlc-3.0.17...32.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    110s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-de
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-delocale:de-deos:windows10-2004-x64systemwindows
  • submitted
    03-11-2022 16:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SumatraPDF-3.4.6-64-install.exe

  • Size

    7.1MB

  • MD5

    5825a6110accced8f5580207c94e2805

  • SHA1

    ec3e46a43e95e4d1f3380f3022ebcbbef49d27af

  • SHA256

    aa79391c7db478fbb969875da39ce09e3e8124b869acc3178f5b6a3b4e10d5ce

  • SHA512

    0b5cef31e7e29337f45502977b0c3293c0041133c353962bf6836ec314ddd474701834d270fa891b1dc2fbecdeab4cde2fa9483f264dc166a86a8ee0d654472e

  • SSDEEP

    196608:gGWpkdKiynKtTuSyM1MeRk9BqHtLKpfX/TL1LKo+7SH94WSv8:6SDXtTrTRk9ButLKpP//1LKo+7SKvv8

Score
8/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SumatraPDF-3.4.6-64-install.exe
    "C:\Users\Admin\AppData\Local\Temp\SumatraPDF-3.4.6-64-install.exe"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\SumatraPDF\SumatraPDF.exe"
      2⤵
        PID:3724
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Users\Admin\AppData\Local\SumatraPDF\SumatraPDF.exe
        "C:\Users\Admin\AppData\Local\SumatraPDF\SumatraPDF.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:4116

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\SumatraPDF\SumatraPDF.exe
      Filesize

      7.1MB

      MD5

      5825a6110accced8f5580207c94e2805

      SHA1

      ec3e46a43e95e4d1f3380f3022ebcbbef49d27af

      SHA256

      aa79391c7db478fbb969875da39ce09e3e8124b869acc3178f5b6a3b4e10d5ce

      SHA512

      0b5cef31e7e29337f45502977b0c3293c0041133c353962bf6836ec314ddd474701834d270fa891b1dc2fbecdeab4cde2fa9483f264dc166a86a8ee0d654472e

      Download Submit

    • C:\Users\Admin\AppData\Local\SumatraPDF\SumatraPDF.exe
      Filesize

      7.1MB

      MD5

      5825a6110accced8f5580207c94e2805

      SHA1

      ec3e46a43e95e4d1f3380f3022ebcbbef49d27af

      SHA256

      aa79391c7db478fbb969875da39ce09e3e8124b869acc3178f5b6a3b4e10d5ce

      SHA512

      0b5cef31e7e29337f45502977b0c3293c0041133c353962bf6836ec314ddd474701834d270fa891b1dc2fbecdeab4cde2fa9483f264dc166a86a8ee0d654472e

      Download Submit

    • C:\Users\Admin\AppData\Local\SumatraPDF\libmupdf.dll
      Filesize

      11.1MB

      MD5

      3f86ec8c34bf38425ab76255c33485ba

      SHA1

      a1cc5894beb7cf3e9d1a0a7c3a570fb091ad50a1

      SHA256

      d8210ac1cb117a92a60794378b73931a233ba71958ea06f1e6382894ce9ef261

      SHA512

      7227906048c5f0aa22626629fab73986158e9077bcaa6f2a9f2b84196ecdd9a4b21ee360b9da7b1372d24462c7da12b9032747e2681199f4c4d758e5b3e8e5dd

      Download Submit

    • C:\Users\Admin\AppData\Local\SumatraPDF\libmupdf.dll
      Filesize

      11.1MB

      MD5

      3f86ec8c34bf38425ab76255c33485ba

      SHA1

      a1cc5894beb7cf3e9d1a0a7c3a570fb091ad50a1

      SHA256

      d8210ac1cb117a92a60794378b73931a233ba71958ea06f1e6382894ce9ef261

      SHA512

      7227906048c5f0aa22626629fab73986158e9077bcaa6f2a9f2b84196ecdd9a4b21ee360b9da7b1372d24462c7da12b9032747e2681199f4c4d758e5b3e8e5dd

      Download Submit

    • memory/3724-132-0x0000000000000000-mapping.dmp

      Download

    • memory/4116-134-0x0000000000000000-mapping.dmp

      Download