Behavioral Report

Analysis

max time kernel
156s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-03-2023 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ReasonLabs/DNS/rsEngine.config
Size

5KB
MD5

6959fd6d232e37c35ef913e10d66809f
SHA1

8781ed0a77fc7cbb5032ae34789b0352e5d740c6
SHA256

ed2cbc633848d2aafdd1e77bb6f3b6063b721b3555bda169ee662d4362a95dd9
SHA512

4d151e3001f379805b68f4834d415c4183fc742278181229851908383b7ee934374550505ed375eda8952055167d9b01d1f461c71c704f158f056d858bcec4e0
SSDEEP

96:xIHfPPfkmXiLorwJ1OLAQbc44dhL6GlDwLr6Qi6kQwI7HDKcPFexQFXwbcdeYgG7:xI/PX0LorNA2M6GJwLr6H6Fw0ZVFXx8m

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

AcroRd32.exe

pid process

604 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

604 AcroRd32.exe
604 AcroRd32.exe
604 AcroRd32.exe

pid	process
604	AcroRd32.exe

pid	process
604	AcroRd32.exe
604	AcroRd32.exe
604	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1788 wrote to memory of 604	1788	cmd.exe	AcroRd32.exe
PID 1788 wrote to memory of 604	1788	cmd.exe	AcroRd32.exe
PID 1788 wrote to memory of 604	1788	cmd.exe	AcroRd32.exe
PID 1788 wrote to memory of 604	1788	cmd.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ReasonLabs\DNS\rsEngine.config
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1788

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ReasonLabs\DNS\rsEngine.config"
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:604

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

00:00 00:00