d803941bd82fe0703dadc646bc1ea0881743d0b2826eff3e9fda7baf930b6802

Analysis

max time kernel
82s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-11-2022 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e
Size

5.1MB
MD5

3b95df58613ef642a6a2f057b9b4c73c
SHA1

0005be24d1c69eec92305e7eec1ad3c594227e73
SHA256

b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e
SHA512

e1b49faf9d254ea335aeede2befe907f02e235c38912cc0deb0be7e26605f9e9581974c33110c0a51f274ba33c055ffdd42a13771bc3d48b164d82bf55667063
SSDEEP

49152:/it3gMpeqVgFxvIzsAWMesEaeTHTd0vdL0ELrx2A0oK4818p5GtNcSgiGUHk5PkD:/YPeqVDBWMPEaUedtLbykh

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	rundll32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1640	7zG.exe
Token: 35	1640	7zG.exe
Token: SeSecurityPrivilege	1640	7zG.exe
Token: SeSecurityPrivilege	1640	7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	7zG.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e
1⤵
PID:1016

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
PID:832

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e
1⤵
- Modifies registry class
PID:1632

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e~\" -spe -an -ai#7zMap10460:200:7zEvent22382
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-54-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download