Analysis
-
max time kernel
152s -
max time network
78s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 23:11
Static task
static1
Behavioral task
behavioral1
Sample
campaign_312-633aed5da8a1e15dd296b1e408bd2ee7.7z
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
campaign_312-633aed5da8a1e15dd296b1e408bd2ee7.7z
Resource
win10v2004-20220901-en
General
-
Target
campaign_312-633aed5da8a1e15dd296b1e408bd2ee7.7z
-
Size
7.2MB
-
MD5
633aed5da8a1e15dd296b1e408bd2ee7
-
SHA1
be1a9bec12fde32b4a17d245346c01145e89a810
-
SHA256
26dd89268839f81f51f5d50e6855bf457d4f916bedbcf2341d1fa235134a13a1
-
SHA512
0c620a191d97880421b6c86d53c7d98a2b52b218e521f0dd6451bf8d8420c3a029c33deb74b8019bd490577cc20b7a94f8338d8b15d97cc9116fffb9b1683a74
-
SSDEEP
98304:i8p2E3sfzRHjpBq+AfuQWzB7M+TdNocYea5Mv4iruwNPD9r0RO1si8XEc7HOFcM9:lp2EERuLfrW9ckPrVN79AXvuFcgSUmR2
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 10 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\7z_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\7z_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.7z\ = "7z_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\7z_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.7z rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\7z_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\7z_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\7z_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 828 AcroRd32.exe 828 AcroRd32.exe 828 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1704 wrote to memory of 1200 1704 cmd.exe rundll32.exe PID 1704 wrote to memory of 1200 1704 cmd.exe rundll32.exe PID 1704 wrote to memory of 1200 1704 cmd.exe rundll32.exe PID 1200 wrote to memory of 828 1200 rundll32.exe AcroRd32.exe PID 1200 wrote to memory of 828 1200 rundll32.exe AcroRd32.exe PID 1200 wrote to memory of 828 1200 rundll32.exe AcroRd32.exe PID 1200 wrote to memory of 828 1200 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\campaign_312-633aed5da8a1e15dd296b1e408bd2ee7.7z1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\campaign_312-633aed5da8a1e15dd296b1e408bd2ee7.7z2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\campaign_312-633aed5da8a1e15dd296b1e408bd2ee7.7z"3⤵
- Suspicious use of SetWindowsHookEx