c67d99fc8f8b47a654e90b86ed992ee933a31ea5b219359dad9b131306ec16c4

Analysis

max time kernel
255s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c67d99fc8f8b47a654e90b86ed992ee933a31ea5b219359dad9b131306ec16c4.exe
Size

43KB
MD5

338c35c21cf983634161cb78bb1857e0
SHA1

00de00066f8fa144112b0d28bd105e2f8c22bb0e
SHA256

c67d99fc8f8b47a654e90b86ed992ee933a31ea5b219359dad9b131306ec16c4
SHA512

a1b7cf0f18f938593c4ec52d629ffd5aa7e8ecbfef06bddeefd8708add6b61fd8bbeaf102196fcd81dd318440081458ac73ac3ac92b61a80c16ae86d8b3dba49
SSDEEP

768:5Cpw7JthQC0PJ7oNGxLllmX1fPH8ANVkrpMumz8z2+r4dR:Apw7JTQbsHEANVgMlppR

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_Classes\Local Settings	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
688	AcroRd32.exe
688	AcroRd32.exe
688	AcroRd32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 676	360	c67d99fc8f8b47a654e90b86ed992ee933a31ea5b219359dad9b131306ec16c4.exe	28
PID 360 wrote to memory of 676	360	c67d99fc8f8b47a654e90b86ed992ee933a31ea5b219359dad9b131306ec16c4.exe	28
PID 360 wrote to memory of 676	360	c67d99fc8f8b47a654e90b86ed992ee933a31ea5b219359dad9b131306ec16c4.exe	28
PID 360 wrote to memory of 676	360	c67d99fc8f8b47a654e90b86ed992ee933a31ea5b219359dad9b131306ec16c4.exe	28
PID 360 wrote to memory of 676	360	c67d99fc8f8b47a654e90b86ed992ee933a31ea5b219359dad9b131306ec16c4.exe	28
PID 360 wrote to memory of 676	360	c67d99fc8f8b47a654e90b86ed992ee933a31ea5b219359dad9b131306ec16c4.exe	28
PID 360 wrote to memory of 676	360	c67d99fc8f8b47a654e90b86ed992ee933a31ea5b219359dad9b131306ec16c4.exe	28
PID 676 wrote to memory of 688	676	rundll32.exe	29
PID 676 wrote to memory of 688	676	rundll32.exe	29
PID 676 wrote to memory of 688	676	rundll32.exe	29
PID 676 wrote to memory of 688	676	rundll32.exe	29

C:\Users\Admin\AppData\Local\Temp\c67d99fc8f8b47a654e90b86ed992ee933a31ea5b219359dad9b131306ec16c4.exe
"C:\Users\Admin\AppData\Local\Temp\c67d99fc8f8b47a654e90b86ed992ee933a31ea5b219359dad9b131306ec16c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:360
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\system
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\system"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\system

Filesize
43KB

MD5
338c35c21cf983634161cb78bb1857e0

SHA1
00de00066f8fa144112b0d28bd105e2f8c22bb0e

SHA256
c67d99fc8f8b47a654e90b86ed992ee933a31ea5b219359dad9b131306ec16c4

SHA512
a1b7cf0f18f938593c4ec52d629ffd5aa7e8ecbfef06bddeefd8708add6b61fd8bbeaf102196fcd81dd318440081458ac73ac3ac92b61a80c16ae86d8b3dba49

Download Submit
memory/360-54-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download
memory/360-55-0x0000000074AD0000-0x000000007507B000-memory.dmp

Filesize
5.7MB

Download
memory/360-58-0x0000000074AD0000-0x000000007507B000-memory.dmp

Filesize
5.7MB

Download