867c5428d815a2f2d26b333c60f12652c294c62bb20ca8092c98a2f5fb546b1b

Analysis

max time kernel
152s
max time network
61s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan-Ransom.Win32.Blocker.exe
Size

392KB
MD5

07e60c5d7dfb6651e00c5f380cd50894
SHA1

330aafef8d4001d1c80c2dfb3d23e979a874a7c5
SHA256

867c5428d815a2f2d26b333c60f12652c294c62bb20ca8092c98a2f5fb546b1b
SHA512

2aabd98293cd18bd426a7eb522502deabee13fe32b17bad3326340d6e3f9048671ce006b4bdbbe0f1dd781546858151277a792c1335e06e7ae211c43b8503d05
SSDEEP

12288:Ot8vVED3Bk0Mr9Vif7/F1hIIaYHuvAIS28:Ot+gvMpVij/F1hV5HuvAIS

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
892	achsv.exe
1492	COM7.EXE
1188	COM7.EXE
520	achsv.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PDF FoxitReader.exe	COM7.EXE

Loads dropped DLL 8 IoCs

pid	Process
1220	Trojan-Ransom.Win32.Blocker.exe
1220	Trojan-Ransom.Win32.Blocker.exe
1220	Trojan-Ransom.Win32.Blocker.exe
1220	Trojan-Ransom.Win32.Blocker.exe
892	achsv.exe
892	achsv.exe
1492	COM7.EXE
1492	COM7.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\COMLOADER = "\\\\.\\C:\\Program Files\\FoxitReader\\bin\\COM7.EXE"	reg.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\FoxitReader\bin\COM7.EXE	COM7.EXE
File created	C:\Program Files\FoxitReader\FoxitReader.exe	COM7.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
836	reg.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1220	Trojan-Ransom.Win32.Blocker.exe
892	achsv.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1220	Trojan-Ransom.Win32.Blocker.exe
1188	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
520	achsv.exe
1220	Trojan-Ransom.Win32.Blocker.exe
1220	Trojan-Ransom.Win32.Blocker.exe
1220	Trojan-Ransom.Win32.Blocker.exe
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE
1220	Trojan-Ransom.Win32.Blocker.exe
1492	COM7.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
892	achsv.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 892	1220	Trojan-Ransom.Win32.Blocker.exe	26
PID 1220 wrote to memory of 892	1220	Trojan-Ransom.Win32.Blocker.exe	26
PID 1220 wrote to memory of 892	1220	Trojan-Ransom.Win32.Blocker.exe	26
PID 1220 wrote to memory of 892	1220	Trojan-Ransom.Win32.Blocker.exe	26
PID 1220 wrote to memory of 1492	1220	Trojan-Ransom.Win32.Blocker.exe	27
PID 1220 wrote to memory of 1492	1220	Trojan-Ransom.Win32.Blocker.exe	27
PID 1220 wrote to memory of 1492	1220	Trojan-Ransom.Win32.Blocker.exe	27
PID 1220 wrote to memory of 1492	1220	Trojan-Ransom.Win32.Blocker.exe	27
PID 1492 wrote to memory of 836	1492	COM7.EXE	28
PID 1492 wrote to memory of 836	1492	COM7.EXE	28
PID 1492 wrote to memory of 836	1492	COM7.EXE	28
PID 1492 wrote to memory of 836	1492	COM7.EXE	28
PID 892 wrote to memory of 1188	892	achsv.exe	30
PID 892 wrote to memory of 1188	892	achsv.exe	30
PID 892 wrote to memory of 1188	892	achsv.exe	30
PID 892 wrote to memory of 1188	892	achsv.exe	30
PID 1492 wrote to memory of 520	1492	COM7.EXE	31
PID 1492 wrote to memory of 520	1492	COM7.EXE	31
PID 1492 wrote to memory of 520	1492	COM7.EXE	31
PID 1492 wrote to memory of 520	1492	COM7.EXE	31

C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
  \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
    \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1188
- C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
  \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v COMLOADER /d "\\.\C:\Program Files\FoxitReader\bin\COM7.EXE"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
    \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE

Filesize
392KB

MD5
975a4ee0275bc11ccc8beaa4d5cb00d7

SHA1
abd50d96aa7268d1f506e566c5d5c9ad783012a8

SHA256
2b58be880efbb850fc8b98546fe5bcc4184cc38d8ee845787802320ab3b3e09f

SHA512
66341bbcefd6790997cc96dbd23cdb34b4e80c6bfa2fda4bb48b69d774fc2ec09a90f7152721c5a44698e2940df4ba00e596b49db59468ab3e545b2255b56a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE

Filesize
392KB

MD5
975a4ee0275bc11ccc8beaa4d5cb00d7

SHA1
abd50d96aa7268d1f506e566c5d5c9ad783012a8

SHA256
2b58be880efbb850fc8b98546fe5bcc4184cc38d8ee845787802320ab3b3e09f

SHA512
66341bbcefd6790997cc96dbd23cdb34b4e80c6bfa2fda4bb48b69d774fc2ec09a90f7152721c5a44698e2940df4ba00e596b49db59468ab3e545b2255b56a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE

Filesize
392KB

MD5
975a4ee0275bc11ccc8beaa4d5cb00d7

SHA1
abd50d96aa7268d1f506e566c5d5c9ad783012a8

SHA256
2b58be880efbb850fc8b98546fe5bcc4184cc38d8ee845787802320ab3b3e09f

SHA512
66341bbcefd6790997cc96dbd23cdb34b4e80c6bfa2fda4bb48b69d774fc2ec09a90f7152721c5a44698e2940df4ba00e596b49db59468ab3e545b2255b56a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe

Filesize
392KB

MD5
903b3ab11fc5ab0139841b841fe1e7a9

SHA1
6acc1e94cf752f7d89edade4e91ac4b2f0dbee38

SHA256
7d7ed8fac1cbfdbbeaad866f770f793cea7ce4c1f5132f1e85046d10c5c8a30c

SHA512
7535801e3742618c257b06e3bc4b0eb37bbecd9e7f9cabe3216fb9a57ba6be686c7e33eac6c8c28995491c65785facc31ed1d7d33ba19f88b9ddaabee521b0d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe

Filesize
392KB

MD5
903b3ab11fc5ab0139841b841fe1e7a9

SHA1
6acc1e94cf752f7d89edade4e91ac4b2f0dbee38

SHA256
7d7ed8fac1cbfdbbeaad866f770f793cea7ce4c1f5132f1e85046d10c5c8a30c

SHA512
7535801e3742618c257b06e3bc4b0eb37bbecd9e7f9cabe3216fb9a57ba6be686c7e33eac6c8c28995491c65785facc31ed1d7d33ba19f88b9ddaabee521b0d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe

Filesize
392KB

MD5
903b3ab11fc5ab0139841b841fe1e7a9

SHA1
6acc1e94cf752f7d89edade4e91ac4b2f0dbee38

SHA256
7d7ed8fac1cbfdbbeaad866f770f793cea7ce4c1f5132f1e85046d10c5c8a30c

SHA512
7535801e3742618c257b06e3bc4b0eb37bbecd9e7f9cabe3216fb9a57ba6be686c7e33eac6c8c28995491c65785facc31ed1d7d33ba19f88b9ddaabee521b0d0

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE

Filesize
392KB

MD5
975a4ee0275bc11ccc8beaa4d5cb00d7

SHA1
abd50d96aa7268d1f506e566c5d5c9ad783012a8

SHA256
2b58be880efbb850fc8b98546fe5bcc4184cc38d8ee845787802320ab3b3e09f

SHA512
66341bbcefd6790997cc96dbd23cdb34b4e80c6bfa2fda4bb48b69d774fc2ec09a90f7152721c5a44698e2940df4ba00e596b49db59468ab3e545b2255b56a0e

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE

Filesize
392KB

MD5
975a4ee0275bc11ccc8beaa4d5cb00d7

SHA1
abd50d96aa7268d1f506e566c5d5c9ad783012a8

SHA256
2b58be880efbb850fc8b98546fe5bcc4184cc38d8ee845787802320ab3b3e09f

SHA512
66341bbcefd6790997cc96dbd23cdb34b4e80c6bfa2fda4bb48b69d774fc2ec09a90f7152721c5a44698e2940df4ba00e596b49db59468ab3e545b2255b56a0e

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE

Filesize
392KB

MD5
975a4ee0275bc11ccc8beaa4d5cb00d7

SHA1
abd50d96aa7268d1f506e566c5d5c9ad783012a8

SHA256
2b58be880efbb850fc8b98546fe5bcc4184cc38d8ee845787802320ab3b3e09f

SHA512
66341bbcefd6790997cc96dbd23cdb34b4e80c6bfa2fda4bb48b69d774fc2ec09a90f7152721c5a44698e2940df4ba00e596b49db59468ab3e545b2255b56a0e

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE

Filesize
392KB

MD5
975a4ee0275bc11ccc8beaa4d5cb00d7

SHA1
abd50d96aa7268d1f506e566c5d5c9ad783012a8

SHA256
2b58be880efbb850fc8b98546fe5bcc4184cc38d8ee845787802320ab3b3e09f

SHA512
66341bbcefd6790997cc96dbd23cdb34b4e80c6bfa2fda4bb48b69d774fc2ec09a90f7152721c5a44698e2940df4ba00e596b49db59468ab3e545b2255b56a0e

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe

Filesize
392KB

MD5
903b3ab11fc5ab0139841b841fe1e7a9

SHA1
6acc1e94cf752f7d89edade4e91ac4b2f0dbee38

SHA256
7d7ed8fac1cbfdbbeaad866f770f793cea7ce4c1f5132f1e85046d10c5c8a30c

SHA512
7535801e3742618c257b06e3bc4b0eb37bbecd9e7f9cabe3216fb9a57ba6be686c7e33eac6c8c28995491c65785facc31ed1d7d33ba19f88b9ddaabee521b0d0

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe

Filesize
392KB

MD5
903b3ab11fc5ab0139841b841fe1e7a9

SHA1
6acc1e94cf752f7d89edade4e91ac4b2f0dbee38

SHA256
7d7ed8fac1cbfdbbeaad866f770f793cea7ce4c1f5132f1e85046d10c5c8a30c

SHA512
7535801e3742618c257b06e3bc4b0eb37bbecd9e7f9cabe3216fb9a57ba6be686c7e33eac6c8c28995491c65785facc31ed1d7d33ba19f88b9ddaabee521b0d0

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe

Filesize
392KB

MD5
903b3ab11fc5ab0139841b841fe1e7a9

SHA1
6acc1e94cf752f7d89edade4e91ac4b2f0dbee38

SHA256
7d7ed8fac1cbfdbbeaad866f770f793cea7ce4c1f5132f1e85046d10c5c8a30c

SHA512
7535801e3742618c257b06e3bc4b0eb37bbecd9e7f9cabe3216fb9a57ba6be686c7e33eac6c8c28995491c65785facc31ed1d7d33ba19f88b9ddaabee521b0d0

Download Submit
\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe

Filesize
392KB

MD5
903b3ab11fc5ab0139841b841fe1e7a9

SHA1
6acc1e94cf752f7d89edade4e91ac4b2f0dbee38

SHA256
7d7ed8fac1cbfdbbeaad866f770f793cea7ce4c1f5132f1e85046d10c5c8a30c

SHA512
7535801e3742618c257b06e3bc4b0eb37bbecd9e7f9cabe3216fb9a57ba6be686c7e33eac6c8c28995491c65785facc31ed1d7d33ba19f88b9ddaabee521b0d0

Download Submit
memory/1220-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download