Analysis
-
max time kernel
53s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
27/12/2022, 23:13
General
-
Target
edrawmax.exe
-
Size
76.7MB
-
MD5
424ae6a1cbc78cb0f81380eaf75f6a00
-
SHA1
33772dd3170ff5ee4f2be1cd9eee82836aceb594
-
SHA256
e4b73e23cf600d4fee331e7300d86a8faa1a945751ad8646792d76cfe9bb4f37
-
SHA512
5704d24286df84c06b6c492fa256f28ef0a9d4d2a339c13566bbde3c2950b1e33e11e40471cd7c7f57d4453d32959ba2b2d97b46ef2098be691d14d3e55e8f6e
-
SSDEEP
1572864:XCm67nYuItrprOEQOoEXJi6SJENV7qz7xZPZt2K2liIVObDBgeZxx3VQQoNv58sz:mnRIrIErEuVcFjt2d1wnBgI1VQQoNvOu
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 14 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\edrawmax.exe"C:\Users\Admin\AppData\Local\Temp\edrawmax.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-EBRDO.tmp\edrawmax.tmp"C:\Users\Admin\AppData\Local\Temp\is-EBRDO.tmp\edrawmax.tmp" /SL5="$70124,79961065,129536,C:\Users\Admin\AppData\Local\Temp\edrawmax.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Edraw Max\ThumbView.dll"3⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Edraw Max\officeviewer.ocx"3⤵
- Loads dropped DLL
- Modifies registry class
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
411KB
MD532e390954b2c6b1583a969ed0e7c8a9d
SHA1fb1dccbabd587a12508127abff7b3c8bf6c2bb1a
SHA256bcb4e8143322025f1b4c66e75dbfff0495338b617c103b0ac14299d5badd4185
SHA5125c4a01e867d2f358c15ccb7aa78a2384237ad9dae83602f8eea388941b11e85ecefcc21040f439da3f21ac1916c75377c55693df86251d30d1bed3726d21f557
-
Filesize
750KB
MD52b92a88e329f4845d31941967a3baa90
SHA1bbf341e7ed9947de0b5d84d93ca0bc4c8beb5500
SHA256649a7ab8e3b5c0940812e40eafc8f004979bb48bfc8f4bc7db9f2cbcdd715344
SHA512b94862e3f516402317a5467c6e0ff3dd23a967d90dae87dec1687157e43978c2d73c24fee71b4febeada54bb433ea4fcd16568d02fde1c4f9f50f6d7ba02408a
-
Filesize
140KB
MD5b2fe932bcd8b2edbecb2f8812a7acc78
SHA1cec3b1af6fd98a963437c652352d22f60f069a09
SHA256a66c2d2f100b7777e5cec636a1845ef48fb8df8143e22c68791c5e18125d0234
SHA51226a69981489d9db741e24c6c532a1d04f1e87d82540a71fc3e195fa587894eb759d32a04d9bc886e790b2f1a4be50477c2d4c5a9317068022c733123693e9be2
-
Filesize
4.2MB
MD5c67a6fa10a94746c5f65c656646ae216
SHA180fc21ed06ad06d3c0d8c15e52bfd03376b35e9d
SHA256abeb2d80384af1b1a5fae7fc21c3f6ead04cceb01d34a4255a14a194dd4ccfe2
SHA5121155ec3c59f30e0b826010dda38330cbed44b270b735eff44fcd782553bfc11dc8fc284657743414b74f92f07d3eb788d390ac516291cc3e03b2bd83dacb5217
-
Filesize
2.1MB
MD50d8e2e800914f489a70eb50704d4def7
SHA175191d3f4779a867c6717f5bd0052d2d986f3d70
SHA256ecbfd6e6bbc26850a617bc0ba6bb6de09d12121e36d137e508b5983d9a852d6e
SHA512c6acb103610c4131fba4a15261d9261f37e3c88621d6474c40e239f4fa3845994e1cf0d00b65d23a20b352cc0c220f59a4167f8d86846bc4315a68c81deb5a33
-
Filesize
1.1MB
MD59ffcdcabde63d087ecc8368add047c18
SHA14f050e05dea58e22f8ce966483a330ab68fc2893
SHA256430db47c54d1bd4aa944f533fb78a545e257d6dcfeab8da0ec9c2d50bf0577ea
SHA512b0838fe22da39dd2b47fa5c8ebadb36be5ff121750f8bb66e45e51e130a103acbed375537fbb51b9bf0456a504e9a6fb678802e24e98ffe4166a3ad12d61d07d
-
Filesize
1.1MB
MD59ffcdcabde63d087ecc8368add047c18
SHA14f050e05dea58e22f8ce966483a330ab68fc2893
SHA256430db47c54d1bd4aa944f533fb78a545e257d6dcfeab8da0ec9c2d50bf0577ea
SHA512b0838fe22da39dd2b47fa5c8ebadb36be5ff121750f8bb66e45e51e130a103acbed375537fbb51b9bf0456a504e9a6fb678802e24e98ffe4166a3ad12d61d07d
-
Filesize
5.6MB
MD5f5cd0973fe299ee638d38f8dab7dc33a
SHA1204aaf7a21666a809c9f54e20e0ca076fc93406a
SHA256c3531dc825c4b0ff87693ad729456b2f6dbbdad08287e7b532817f743765f54c
SHA512b860e52044f8412e1c4f2a55b4040f8f0ae8964c9c392dfb07c9cc0469881e227e3f4faab57b38017ab6beb34c4fd93827be294c09b1fe6c67e8cbad2b301e26
-
Filesize
140KB
MD5b2fe932bcd8b2edbecb2f8812a7acc78
SHA1cec3b1af6fd98a963437c652352d22f60f069a09
SHA256a66c2d2f100b7777e5cec636a1845ef48fb8df8143e22c68791c5e18125d0234
SHA51226a69981489d9db741e24c6c532a1d04f1e87d82540a71fc3e195fa587894eb759d32a04d9bc886e790b2f1a4be50477c2d4c5a9317068022c733123693e9be2
-
Filesize
140KB
MD5b2fe932bcd8b2edbecb2f8812a7acc78
SHA1cec3b1af6fd98a963437c652352d22f60f069a09
SHA256a66c2d2f100b7777e5cec636a1845ef48fb8df8143e22c68791c5e18125d0234
SHA51226a69981489d9db741e24c6c532a1d04f1e87d82540a71fc3e195fa587894eb759d32a04d9bc886e790b2f1a4be50477c2d4c5a9317068022c733123693e9be2
-
Filesize
140KB
MD5b2fe932bcd8b2edbecb2f8812a7acc78
SHA1cec3b1af6fd98a963437c652352d22f60f069a09
SHA256a66c2d2f100b7777e5cec636a1845ef48fb8df8143e22c68791c5e18125d0234
SHA51226a69981489d9db741e24c6c532a1d04f1e87d82540a71fc3e195fa587894eb759d32a04d9bc886e790b2f1a4be50477c2d4c5a9317068022c733123693e9be2
-
Filesize
4.2MB
MD5c67a6fa10a94746c5f65c656646ae216
SHA180fc21ed06ad06d3c0d8c15e52bfd03376b35e9d
SHA256abeb2d80384af1b1a5fae7fc21c3f6ead04cceb01d34a4255a14a194dd4ccfe2
SHA5121155ec3c59f30e0b826010dda38330cbed44b270b735eff44fcd782553bfc11dc8fc284657743414b74f92f07d3eb788d390ac516291cc3e03b2bd83dacb5217
-
Filesize
411KB
MD532e390954b2c6b1583a969ed0e7c8a9d
SHA1fb1dccbabd587a12508127abff7b3c8bf6c2bb1a
SHA256bcb4e8143322025f1b4c66e75dbfff0495338b617c103b0ac14299d5badd4185
SHA5125c4a01e867d2f358c15ccb7aa78a2384237ad9dae83602f8eea388941b11e85ecefcc21040f439da3f21ac1916c75377c55693df86251d30d1bed3726d21f557
-
Filesize
750KB
MD52b92a88e329f4845d31941967a3baa90
SHA1bbf341e7ed9947de0b5d84d93ca0bc4c8beb5500
SHA256649a7ab8e3b5c0940812e40eafc8f004979bb48bfc8f4bc7db9f2cbcdd715344
SHA512b94862e3f516402317a5467c6e0ff3dd23a967d90dae87dec1687157e43978c2d73c24fee71b4febeada54bb433ea4fcd16568d02fde1c4f9f50f6d7ba02408a
-
Filesize
2.1MB
MD50d8e2e800914f489a70eb50704d4def7
SHA175191d3f4779a867c6717f5bd0052d2d986f3d70
SHA256ecbfd6e6bbc26850a617bc0ba6bb6de09d12121e36d137e508b5983d9a852d6e
SHA512c6acb103610c4131fba4a15261d9261f37e3c88621d6474c40e239f4fa3845994e1cf0d00b65d23a20b352cc0c220f59a4167f8d86846bc4315a68c81deb5a33
-
Filesize
2.1MB
MD50d8e2e800914f489a70eb50704d4def7
SHA175191d3f4779a867c6717f5bd0052d2d986f3d70
SHA256ecbfd6e6bbc26850a617bc0ba6bb6de09d12121e36d137e508b5983d9a852d6e
SHA512c6acb103610c4131fba4a15261d9261f37e3c88621d6474c40e239f4fa3845994e1cf0d00b65d23a20b352cc0c220f59a4167f8d86846bc4315a68c81deb5a33
-
Filesize
2.1MB
MD50d8e2e800914f489a70eb50704d4def7
SHA175191d3f4779a867c6717f5bd0052d2d986f3d70
SHA256ecbfd6e6bbc26850a617bc0ba6bb6de09d12121e36d137e508b5983d9a852d6e
SHA512c6acb103610c4131fba4a15261d9261f37e3c88621d6474c40e239f4fa3845994e1cf0d00b65d23a20b352cc0c220f59a4167f8d86846bc4315a68c81deb5a33
-
Filesize
1.1MB
MD561db29c3153410aac8287216d841f76d
SHA1ea503bd2b347fd8bfed3ea3c507dd0fef6a0de80
SHA2563245485df4f2dffe76234de12ef86f74cc5b5dd466140e45d6352e788ea3964a
SHA5121fc0cf6a4e35af580fc8479b0dcf7d3743d8b20231fdebd9727420d8c87c23bb3875b96947e43ecd1042f0e2a5601b62b3e01929d69a246387a4ebe63519e735
-
Filesize
1.1MB
MD59ffcdcabde63d087ecc8368add047c18
SHA14f050e05dea58e22f8ce966483a330ab68fc2893
SHA256430db47c54d1bd4aa944f533fb78a545e257d6dcfeab8da0ec9c2d50bf0577ea
SHA512b0838fe22da39dd2b47fa5c8ebadb36be5ff121750f8bb66e45e51e130a103acbed375537fbb51b9bf0456a504e9a6fb678802e24e98ffe4166a3ad12d61d07d
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB