32aaffb3abfa622c185dd01ebd7c7e72bed07f9a5f1bdad151ab163a42ab8a80

Analysis

max time kernel
1810s
max time network
1839s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 15:57

Target

Payload/YouTube.app/Frameworks/iSponsorBlock.dylib
Size

270KB
MD5

f77bba263dc0b492185cb495a80207f1
SHA1

ab9b0692abf3e021ebb82bb45a7b8c6c6bb4f23c
SHA256

52343466bba775a752138613f154b7a2e2a8903b41014bb86b0c7f39f5c2e371
SHA512

af1c927158de67fd809a0b71885044b8511bef69adb57f8a0906a1f6de6c64dfe7dbc8fe89d66d0a0bacd85979e3bda1ac294116c0313096f1c7220b5c0e3cf7
SSDEEP

6144:HAUTKiv0SyGF1Uk5qcebWXxwG6rlcpfOaOvemICFh7:gksS5qcebWXxwG6rlcpfOaMpFh7

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\dylib_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.dylib	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\dylib_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\dylib_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.dylib\ = "dylib_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\dylib_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\dylib_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\dylib_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1552 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1552 AcroRd32.exe
1552 AcroRd32.exe
1552 AcroRd32.exe

pid	process
1552	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1888 wrote to memory of 704	1888	cmd.exe	rundll32.exe
PID 1888 wrote to memory of 704	1888	cmd.exe	rundll32.exe
PID 1888 wrote to memory of 704	1888	cmd.exe	rundll32.exe
PID 704 wrote to memory of 1552	704	rundll32.exe	AcroRd32.exe
PID 704 wrote to memory of 1552	704	rundll32.exe	AcroRd32.exe
PID 704 wrote to memory of 1552	704	rundll32.exe	AcroRd32.exe
PID 704 wrote to memory of 1552	704	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Payload\YouTube.app\Frameworks\iSponsorBlock.dylib
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Payload\YouTube.app\Frameworks\iSponsorBlock.dylib
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Payload\YouTube.app\Frameworks\iSponsorBlock.dylib"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1552

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/704-76-0x0000000000000000-mapping.dmp

Download
memory/1552-81-0x0000000000000000-mapping.dmp

Download
memory/1552-82-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/1888-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download