a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a

Analysis

max time kernel
151s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a.exe
Size

93KB
MD5

68a61ca1554b4cef07ce9a3bfd6b9420
SHA1

f021e2be271e5f53536f362880b797b3d959f037
SHA256

a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a
SHA512

97d93b8e17aae938d82ab790fb65f72ec9e2e48fddbf04ce1bde23be41af465ae27e5012b0850a3a8a11ee63bc34a8913bec0110ef8ec9d1b03439f3cba2bf79
SSDEEP

1536:umPBKFKlazNAAwbXqrJSNgw27tNfYH16Me:JPBKFoazN0q0v2xG12

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1796	AcroRd32.exe
1796	AcroRd32.exe
1796	AcroRd32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1548	1384	a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a.exe	27
PID 1384 wrote to memory of 1548	1384	a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a.exe	27
PID 1384 wrote to memory of 1548	1384	a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a.exe	27
PID 1384 wrote to memory of 1548	1384	a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a.exe	27
PID 1384 wrote to memory of 1548	1384	a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a.exe	27
PID 1384 wrote to memory of 1548	1384	a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a.exe	27
PID 1384 wrote to memory of 1548	1384	a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a.exe	27
PID 1548 wrote to memory of 1796	1548	rundll32.exe	28
PID 1548 wrote to memory of 1796	1548	rundll32.exe	28
PID 1548 wrote to memory of 1796	1548	rundll32.exe	28
PID 1548 wrote to memory of 1796	1548	rundll32.exe	28

C:\Users\Admin\AppData\Local\Temp\a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a.exe
"C:\Users\Admin\AppData\Local\Temp\a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\IDM
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IDM"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IDM

Filesize
93KB

MD5
68a61ca1554b4cef07ce9a3bfd6b9420

SHA1
f021e2be271e5f53536f362880b797b3d959f037

SHA256
a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a

SHA512
97d93b8e17aae938d82ab790fb65f72ec9e2e48fddbf04ce1bde23be41af465ae27e5012b0850a3a8a11ee63bc34a8913bec0110ef8ec9d1b03439f3cba2bf79

Download Submit
memory/1384-54-0x0000000076701000-0x0000000076703000-memory.dmp

Filesize
8KB

Download
memory/1384-55-0x0000000074EC0000-0x000000007546B000-memory.dmp

Filesize
5.7MB

Download
memory/1384-57-0x0000000074EC0000-0x000000007546B000-memory.dmp

Filesize
5.7MB

Download