Analysis
-
max time kernel
152s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 00:04
Static task
static1
Behavioral task
behavioral1
Sample
6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe
-
Size
152KB
-
MD5
7e12640bc065bd9bc82d11bf7d6522ff
-
SHA1
08c1721fb0d2b8851e89e25f0ea39b2237ef1e26
-
SHA256
6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8
-
SHA512
9facb67a1fa3af772055dc13de09898cd4a738ea46441a0c2c8282ad93ed8e2091301298fb9d0902eb84d0633bdc247aa0556031050c5f34704963bd3051dc00
-
SSDEEP
3072:BhUFgQTQtKrueiygR4O6avJamofZ4oQZiEcJTh:2gEQtKSMgR56avUm2WSj
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rslad.exe -
Executes dropped EXE 1 IoCs
pid Process 1480 rslad.exe -
Loads dropped DLL 2 IoCs
pid Process 1148 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe 1148 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /V" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /n" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /N" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /G" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /v" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /E" rslad.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /y" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /X" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /x" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /o" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /P" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /D" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /T" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /t" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /B" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /u" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /K" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /d" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /J" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /U" 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /O" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /j" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /A" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /s" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /F" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /H" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /i" rslad.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /l" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /c" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /m" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /p" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /k" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /e" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /S" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /z" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /C" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /a" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /Z" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /b" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /U" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /f" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /g" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /q" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /h" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /W" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /M" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /r" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /L" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /Q" rslad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rslad = "C:\\Users\\Admin\\rslad.exe /I" rslad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1148 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe 1480 rslad.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1148 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe 1480 rslad.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1148 wrote to memory of 1480 1148 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe 27 PID 1148 wrote to memory of 1480 1148 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe 27 PID 1148 wrote to memory of 1480 1148 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe 27 PID 1148 wrote to memory of 1480 1148 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe"C:\Users\Admin\AppData\Local\Temp\6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\rslad.exe"C:\Users\Admin\rslad.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1480
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD58eddb2749cc37714789926234ee3e1ef
SHA17e21d5df504d017911f4e7f0bffc982fb62a4fc7
SHA25603565175c7a6600db1430c58c3432add055cd1992574bea13020aed274d54a85
SHA5123ea1a20aff1473719fdfb900fe7c0d387e8dd320376bd9d64beeb1d10a43948438c48f6c41dc363d70e03087040e512f503100155e7bc4c70f1cad8ed0c09e3f
-
Filesize
152KB
MD58eddb2749cc37714789926234ee3e1ef
SHA17e21d5df504d017911f4e7f0bffc982fb62a4fc7
SHA25603565175c7a6600db1430c58c3432add055cd1992574bea13020aed274d54a85
SHA5123ea1a20aff1473719fdfb900fe7c0d387e8dd320376bd9d64beeb1d10a43948438c48f6c41dc363d70e03087040e512f503100155e7bc4c70f1cad8ed0c09e3f
-
Filesize
152KB
MD58eddb2749cc37714789926234ee3e1ef
SHA17e21d5df504d017911f4e7f0bffc982fb62a4fc7
SHA25603565175c7a6600db1430c58c3432add055cd1992574bea13020aed274d54a85
SHA5123ea1a20aff1473719fdfb900fe7c0d387e8dd320376bd9d64beeb1d10a43948438c48f6c41dc363d70e03087040e512f503100155e7bc4c70f1cad8ed0c09e3f
-
Filesize
152KB
MD58eddb2749cc37714789926234ee3e1ef
SHA17e21d5df504d017911f4e7f0bffc982fb62a4fc7
SHA25603565175c7a6600db1430c58c3432add055cd1992574bea13020aed274d54a85
SHA5123ea1a20aff1473719fdfb900fe7c0d387e8dd320376bd9d64beeb1d10a43948438c48f6c41dc363d70e03087040e512f503100155e7bc4c70f1cad8ed0c09e3f