6df17ee2db1e11f4c41f4066dd2a7f3b574d0f1098fcdf2e847d92ff8db95837

Analysis

max time kernel
153s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

System Volume Information/WPSettings.dat
Size

12B
MD5

09d461fdadf39fa702d61cca24e6317e
SHA1

9f257178f279c65d21b91987114075579b95fbef
SHA256

93ac1052dc52572fb6c45ad76360093b64bc0d830379a4d6b3e5a0d53f165d12
SHA512

c99ae5de36b4fbfa768a025453a1f316a3ca7c76a8bbef15e9cfb61114cd2637896167064cfe163769ff7f2aac363a4f99131e2d128ced78e618353661dedff2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\dat_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\dat_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.dat\ = "dat_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\dat_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.dat	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\dat_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\dat_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

600 AcroRd32.exe
600 AcroRd32.exe
600 AcroRd32.exe

pid	process
600	AcroRd32.exe
600	AcroRd32.exe
600	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 580 wrote to memory of 1416	580	cmd.exe	rundll32.exe
PID 580 wrote to memory of 1416	580	cmd.exe	rundll32.exe
PID 580 wrote to memory of 1416	580	cmd.exe	rundll32.exe
PID 1416 wrote to memory of 600	1416	rundll32.exe	AcroRd32.exe
PID 1416 wrote to memory of 600	1416	rundll32.exe	AcroRd32.exe
PID 1416 wrote to memory of 600	1416	rundll32.exe	AcroRd32.exe
PID 1416 wrote to memory of 600	1416	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\System Volume Information\WPSettings.dat"
1⤵
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\System Volume Information\WPSettings.dat
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1416

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\System Volume Information\WPSettings.dat"
3⤵
- Suspicious use of SetWindowsHookEx
PID:600

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-54-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmp

Filesize
8KB

Download
memory/600-81-0x0000000000000000-mapping.dmp

Download
memory/600-82-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1416-76-0x0000000000000000-mapping.dmp

Download