a549dcca9260e4aae7c600c766b8b0e75acf2937490985435de413f355784dbb

Analysis

max time kernel
124s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-12-2022 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a549dcca9260e4aae7c600c766b8b0e75acf2937490985435de413f355784dbb.dex
Size

936KB
MD5

18d2ba1a7a6be5c364ca81b0140ecb25
SHA1

28cad0fa4fc34e85698ade3e39a10afd51f13872
SHA256

a549dcca9260e4aae7c600c766b8b0e75acf2937490985435de413f355784dbb
SHA512

b20cb3de8756691a8412a409a256f2d54caec9994b335d560f8daf735a80988220bff9e9c2ee1d10a2a2d554b562c10faf9293459880f1bd5f13f5a8708cd1ad
SSDEEP

12288:uNbHZ9Iwcggy9qadIDId4pnrhz/YboRSNdDonIhxiLt5S77LKJzhHm8yOjgw:m59ag/dIBrh5QnhpPWgE

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2032	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2032	1232	cmd.exe	29
PID 1232 wrote to memory of 2032	1232	cmd.exe	29
PID 1232 wrote to memory of 2032	1232	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\a549dcca9260e4aae7c600c766b8b0e75acf2937490985435de413f355784dbb.dex
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\a549dcca9260e4aae7c600c766b8b0e75acf2937490985435de413f355784dbb.dex
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-54-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

Filesize
8KB

Download