17c86d6ffd92f7e3842f4cc221d38d6d71d2ffb24fc8085f8bed74c7aa99f26f

Analysis

max time kernel
29s
max time network
32s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
15/03/2023, 01:58

Target

RarReg.key
Size

485B
MD5

74edbb4eaafcc273911978cff8741438
SHA1

4f75d9433f8c7672789c924583fdac40d24f4dc8
SHA256

17c86d6ffd92f7e3842f4cc221d38d6d71d2ffb24fc8085f8bed74c7aa99f26f
SHA512

15305e12877f43552e1da0b490fa2f9aea1227709140985aaba3fb09b095a8ad8bf395f600198b522fc5e9ff371139c37db7cd686fd471333b0f841e3d481f5f

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
984	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 984	936	cmd.exe	29
PID 936 wrote to memory of 984	936	cmd.exe	29
PID 936 wrote to memory of 984	936	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RarReg.key
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RarReg.key
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:984

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact