Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 20:51
Static task
static1
Behavioral task
behavioral1
Sample
current/06917 Dec 01.vhd
Resource
macos-20220504-en
Behavioral task
behavioral2
Sample
06917 Dec 01.lnk
Resource
win7-20220812-en
Behavioral task
behavioral3
Sample
06917 Dec 01.lnk
Resource
win10v2004-20220901-en
Behavioral task
behavioral4
Sample
322.dll
Resource
win7-20220812-en
Behavioral task
behavioral5
Sample
322.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral6
Sample
System Volume Information/WPSettings.dat
Resource
win7-20220901-en
Behavioral task
behavioral7
Sample
System Volume Information/WPSettings.dat
Resource
win10v2004-20220812-en
General
-
Target
System Volume Information/WPSettings.dat
-
Size
12B
-
MD5
09d461fdadf39fa702d61cca24e6317e
-
SHA1
9f257178f279c65d21b91987114075579b95fbef
-
SHA256
93ac1052dc52572fb6c45ad76360093b64bc0d830379a4d6b3e5a0d53f165d12
-
SHA512
c99ae5de36b4fbfa768a025453a1f316a3ca7c76a8bbef15e9cfb61114cd2637896167064cfe163769ff7f2aac363a4f99131e2d128ced78e618353661dedff2
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 10 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\dat_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\dat_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\dat_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.dat rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\dat_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.dat\ = "dat_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\dat_auto_file\shell\Read\command rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 1780 AcroRd32.exe 1780 AcroRd32.exe 1780 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1204 wrote to memory of 1056 1204 cmd.exe rundll32.exe PID 1204 wrote to memory of 1056 1204 cmd.exe rundll32.exe PID 1204 wrote to memory of 1056 1204 cmd.exe rundll32.exe PID 1056 wrote to memory of 1780 1056 rundll32.exe AcroRd32.exe PID 1056 wrote to memory of 1780 1056 rundll32.exe AcroRd32.exe PID 1056 wrote to memory of 1780 1056 rundll32.exe AcroRd32.exe PID 1056 wrote to memory of 1780 1056 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\System Volume Information\WPSettings.dat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\System Volume Information\WPSettings.dat2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\System Volume Information\WPSettings.dat"3⤵
- Suspicious use of SetWindowsHookEx