61d6a12a61b3136a89d22eb3d4ee03e5456e64d7c7ada5381142f8e275d52ba9

Analysis

max time kernel
178s
max time network
85s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eteyvfyhrefyscymb/redygnvqehdt.class
Size

790B
MD5

e74d634471d04306d569fd342b333e2b
SHA1

867a167348fa3573533f1f619048740e39abfa56
SHA256

c5a3777c198417f39abcc19a2d98d4976826bdfd062ae9559790a78ed3fd2218
SHA512

d1759f11a10f600200b63262f91af392d25143d0921b660d859f24fd67ba7ef1ba2d651c856b7dc542d495e090b5a30aaf590d72cec35a4dc4b9ac69ed49501c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\class_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\class_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\class_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\.class	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1968	AcroRd32.exe
1968	AcroRd32.exe
1968	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1548	912	cmd.exe	29
PID 912 wrote to memory of 1548	912	cmd.exe	29
PID 912 wrote to memory of 1548	912	cmd.exe	29
PID 1548 wrote to memory of 1968	1548	rundll32.exe	30
PID 1548 wrote to memory of 1968	1548	rundll32.exe	30
PID 1548 wrote to memory of 1968	1548	rundll32.exe	30
PID 1548 wrote to memory of 1968	1548	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\eteyvfyhrefyscymb\redygnvqehdt.class
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\eteyvfyhrefyscymb\redygnvqehdt.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eteyvfyhrefyscymb\redygnvqehdt.class"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-54-0x000007FEFC201000-0x000007FEFC203000-memory.dmp

Filesize
8KB

Download
memory/1968-82-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download