f8f9d2a20b2b0c1aafc075d51dc7df924601b468ba867422419304ac321a2cb7

Analysis

max time kernel
156s
max time network
50s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18-03-2023 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wallpaper_engine/assets/effects/_empty/materials/effects/empty.json
Size

162B
MD5

fa94b38c9e843c61a5afad74ccf46733
SHA1

86a7ac7d17bfde006286b4fb89d7fc701162d375
SHA256

62d100b38cb35b5cf4f6d3e181125bfa22bd81015bd94f86dd951f3f0fbb434d
SHA512

8cc00e0870a2801536e4bf0eed0ba1561a08576a21deea2397b8cabb68b68ee0679bd33a78b5f55284cc60df8a9a78f49fe66801299530ca74a6da9132f5339d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\json_auto_file\	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1292 AcroRd32.exe
1292 AcroRd32.exe
1292 AcroRd32.exe

pid	process
1292	AcroRd32.exe
1292	AcroRd32.exe
1292	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1768 wrote to memory of 1968	1768	cmd.exe	rundll32.exe
PID 1768 wrote to memory of 1968	1768	cmd.exe	rundll32.exe
PID 1768 wrote to memory of 1968	1768	cmd.exe	rundll32.exe
PID 1968 wrote to memory of 1292	1968	rundll32.exe	AcroRd32.exe
PID 1968 wrote to memory of 1292	1968	rundll32.exe	AcroRd32.exe
PID 1968 wrote to memory of 1292	1968	rundll32.exe	AcroRd32.exe
PID 1968 wrote to memory of 1292	1968	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\wallpaper_engine\assets\effects\_empty\materials\effects\empty.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\wallpaper_engine\assets\effects\_empty\materials\effects\empty.json
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1968

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\wallpaper_engine\assets\effects\_empty\materials\effects\empty.json"
3⤵
- Suspicious use of SetWindowsHookEx
PID:1292

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads