bb943a4b69a11e38ae79651edb071f57da2c9989d6b840eae5efcd4e722d774d

Analysis

max time kernel
1594s
max time network
1596s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26-03-2023 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spotify/Block/src/Logger.h
Size

598B
MD5

a7cbf757b651bd3564121d5194261c8a
SHA1

1ab36fb81d47e8cb5606156ce48f2a9a7782a9c8
SHA256

1d42c5ba22af74196385f388ea8c5e38516241541c222a3566348014b3b0e2c3
SHA512

0ce76882526a40ac0a9cab7b64a60c05dd6eff0ca840a82a4151270220cd27295feebaa40f6b001c076de862e4e9732dcfe4705ee6feb3fc7b29b192301a9846

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 12 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\h_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.h\ = "h_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.h	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\h_auto_file\shell\edit	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\h_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\h_auto_file\shell\edit\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\h_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\h_auto_file\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\h_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\h_auto_file\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\h_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1856 NOTEPAD.EXE

pid	process
1856	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1656 wrote to memory of 1556	1656	cmd.exe	rundll32.exe
PID 1656 wrote to memory of 1556	1656	cmd.exe	rundll32.exe
PID 1656 wrote to memory of 1556	1656	cmd.exe	rundll32.exe
PID 1556 wrote to memory of 1856	1556	rundll32.exe	NOTEPAD.EXE
PID 1556 wrote to memory of 1856	1556	rundll32.exe	NOTEPAD.EXE
PID 1556 wrote to memory of 1856	1556	rundll32.exe	NOTEPAD.EXE

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Spotify\Block\src\Logger.h
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Spotify\Block\src\Logger.h
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Spotify\Block\src\Logger.h
3⤵
- Opens file in notepad (likely ransom note)
PID:1856

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads