b5310666a5cf6959c4f2ebcd1988a743197399fd9ad05286d9a8a07a3a1be8fd

Analysis

max time kernel
150s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27/03/2023, 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Suscribete a KuasaR/Unpark CPU/UnparkCPU.vshost.exe.manifest
Size

2KB
MD5

82312969f8bd80ed78f48b1f155bc184
SHA1

71742b1fa6c9a5f5352dc71aba13f45408ecdbb5
SHA256

de573605851f560ebe913b6e3b4f06d88b8c805d4123d1d39cf4f2c9ddc9512f
SHA512

94ce1ed085b6679ba5839683f52514ab1d419c7beaa2c42d31a3177bb8a1d57c9b5e940f9104a0ea1324900868b579963dc0cadd9bcdb68ac8f74b6d0b34d675

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\manifest_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\.manifest	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\.manifest\ = "manifest_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\manifest_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\manifest_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\manifest_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\manifest_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\manifest_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1148	AcroRd32.exe
1148	AcroRd32.exe
1148	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 560	1428	cmd.exe	29
PID 1428 wrote to memory of 560	1428	cmd.exe	29
PID 1428 wrote to memory of 560	1428	cmd.exe	29
PID 560 wrote to memory of 1148	560	rundll32.exe	30
PID 560 wrote to memory of 1148	560	rundll32.exe	30
PID 560 wrote to memory of 1148	560	rundll32.exe	30
PID 560 wrote to memory of 1148	560	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Suscribete a KuasaR\Unpark CPU\UnparkCPU.vshost.exe.manifest"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Suscribete a KuasaR\Unpark CPU\UnparkCPU.vshost.exe.manifest
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Suscribete a KuasaR\Unpark CPU\UnparkCPU.vshost.exe.manifest"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...