8e617da79acb2a47ac187943e9877bf40f1a7a8e45f6e3fb852246580eb91cb2

Analysis

max time kernel
150s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/03/2023, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8E617DA79ACB2A47AC187943E9877BF40F1A7A8E45F6E3FB852246580EB91CB2.bin
Size

2.0MB
MD5

98598caa0f17eaa22af6a2851630f63d
SHA1

b926883e33aaf92485760a5b1e3d558b55355192
SHA256

8e617da79acb2a47ac187943e9877bf40f1a7a8e45f6e3fb852246580eb91cb2
SHA512

ba3412d21337c6ebf9870185f9ba780b58beb7e2914e2af0c6158318a87e4c526133f56b3b899d75ad1d6d189f218b73c365e792ac595368696cf31ea3637118
SSDEEP

49152:MLO8fIhZIew8BL8LazBzI+htzusXPT0CSsFyWqLMpvjY8OI18usCh5iK0oF+cZdL:MLOSIhZIew8BL8LazBzI+htzusXPT0Cf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\bin_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.bin	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\bin_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\bin_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\bin_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.bin\ = "bin_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\bin_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1004	AcroRd32.exe
1004	AcroRd32.exe
1004	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 588	1984	cmd.exe	28
PID 1984 wrote to memory of 588	1984	cmd.exe	28
PID 1984 wrote to memory of 588	1984	cmd.exe	28
PID 588 wrote to memory of 1004	588	rundll32.exe	29
PID 588 wrote to memory of 1004	588	rundll32.exe	29
PID 588 wrote to memory of 1004	588	rundll32.exe	29
PID 588 wrote to memory of 1004	588	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\8E617DA79ACB2A47AC187943E9877BF40F1A7A8E45F6E3FB852246580EB91CB2.bin
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\8E617DA79ACB2A47AC187943E9877BF40F1A7A8E45F6E3FB852246580EB91CB2.bin
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:588
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8E617DA79ACB2A47AC187943E9877BF40F1A7A8E45F6E3FB852246580EB91CB2.bin"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...