826f2a2a25f7b7d42f54d18a99f6721f855ba903db7b125d7dea63d0e4e6df64

Analysis

max time kernel
151s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:46

Target

Job_Description.vhd
Size

13.0MB
MD5

3ce53609211cae4c925b9fee88c7380e
SHA1

2ca125424de74d2385c01f5d8b7bed77feebbda9
SHA256

826f2a2a25f7b7d42f54d18a99f6721f855ba903db7b125d7dea63d0e4e6df64
SHA512

79ca4164e4badfbccd532b6c09f74dbe805490a92a8bd2df480a8bbc1ae3697f066955ca3c44d50afc552bde1b778f3df9f7c40959eed48efa680ffcd627fe9e
SSDEEP

49152:Kb/Gr8SoHQSOOkwPOiA/86xLa8jBaV9SfpOYqQ/jBJictNmIvc8qB:rr8ZhkYm86tjjUCOqjbiUNmQbq

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\vhd_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\vhd_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\vhd_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\vhd_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.vhd	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\vhd_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\vhd_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.vhd\ = "vhd_auto_file"	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1328 AcroRd32.exe
1328 AcroRd32.exe
1328 AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1700 wrote to memory of 1120	1700	cmd.exe	rundll32.exe
PID 1700 wrote to memory of 1120	1700	cmd.exe	rundll32.exe
PID 1700 wrote to memory of 1120	1700	cmd.exe	rundll32.exe
PID 1120 wrote to memory of 1328	1120	rundll32.exe	AcroRd32.exe
PID 1120 wrote to memory of 1328	1120	rundll32.exe	AcroRd32.exe
PID 1120 wrote to memory of 1328	1120	rundll32.exe	AcroRd32.exe
PID 1120 wrote to memory of 1328	1120	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Job_Description.vhd
1⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Job_Description.vhd"
3⤵
- Suspicious use of SetWindowsHookEx
PID:1328

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1120-76-0x0000000000000000-mapping.dmp

Download
memory/1328-81-0x0000000000000000-mapping.dmp

Download
memory/1328-82-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1700-54-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

Filesize
8KB

Download