Overview
overview
10Static
static
00790 Dec 01.vhd
macos-10.15-amd64
1out.vhd
macos-10.15-amd64
00790 Dec 01.lnk
windows7-x64
1000790 Dec 01.lnk
windows10-2004-x64
1048.dll
windows7-x64
148.dll
windows10-2004-x64
1System Vol...meGuid
windows7-x64
1System Vol...meGuid
windows10-2004-x64
1System Vol...gs.dat
windows7-x64
3System Vol...gs.dat
windows10-2004-x64
3Analysis
-
max time kernel
151s -
max time network
69s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
00790 Dec 01.vhd
Resource
macos-20220504-en
Behavioral task
behavioral2
Sample
out.vhd
Resource
macos-20220504-en
Behavioral task
behavioral3
Sample
00790 Dec 01.lnk
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
00790 Dec 01.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
48.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
48.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
System Volume Information/IndexerVolumeGuid
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
System Volume Information/IndexerVolumeGuid
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
System Volume Information/WPSettings.dat
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
System Volume Information/WPSettings.dat
Resource
win10v2004-20220812-en
General
-
Target
System Volume Information/WPSettings.dat
-
Size
12B
-
MD5
09d461fdadf39fa702d61cca24e6317e
-
SHA1
9f257178f279c65d21b91987114075579b95fbef
-
SHA256
93ac1052dc52572fb6c45ad76360093b64bc0d830379a4d6b3e5a0d53f165d12
-
SHA512
c99ae5de36b4fbfa768a025453a1f316a3ca7c76a8bbef15e9cfb61114cd2637896167064cfe163769ff7f2aac363a4f99131e2d128ced78e618353661dedff2
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 10 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\dat_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\dat_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.dat rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\dat_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.dat\ = "dat_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\dat_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\dat_auto_file\shell\Read\command rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 756 AcroRd32.exe 756 AcroRd32.exe 756 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 940 wrote to memory of 2040 940 cmd.exe rundll32.exe PID 940 wrote to memory of 2040 940 cmd.exe rundll32.exe PID 940 wrote to memory of 2040 940 cmd.exe rundll32.exe PID 2040 wrote to memory of 756 2040 rundll32.exe AcroRd32.exe PID 2040 wrote to memory of 756 2040 rundll32.exe AcroRd32.exe PID 2040 wrote to memory of 756 2040 rundll32.exe AcroRd32.exe PID 2040 wrote to memory of 756 2040 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\System Volume Information\WPSettings.dat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\System Volume Information\WPSettings.dat2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\System Volume Information\WPSettings.dat"3⤵
- Suspicious use of SetWindowsHookEx