Behavioral Report

Analysis

max time kernel
90s
max time network
31s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
27-03-2023 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Victoria537/LNG/Español.lng
Size

42KB
MD5

9c1a4869b6be1974ffac76af96f1b4b4
SHA1

ef83cdfc7f9af0f44113669cafaa2bdd7b34e340
SHA256

585a86f13d2c91500ecb2afb1e6d4f81e5b00fe6b7a218a1756d04ef0f7e7697
SHA512

d6420444e9e4bb4c6200ceb017e01bfa6fb3d49c955ff62d8976692f246d8124c02c261b8c715cd2f8faff48baa617d1138f4ab49d632fb2be44da484d44c1a9
SSDEEP

768:51D5Jh3B8d057+dNXN1KfzHPNRe8MoRnRuyMjMDD3gpZUtcsDkrT/ZqVltrprawC:5ZE6odFN1KfbTTMuRttgYdQrT/YLtdmf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

520 rundll32.exe

pid	process
520	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 276 wrote to memory of 520	276	cmd.exe	rundll32.exe
PID 276 wrote to memory of 520	276	cmd.exe	rundll32.exe
PID 276 wrote to memory of 520	276	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Victoria537\LNG\Español.lng
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Victoria537\LNG\Español.lng
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:520

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

00:00 00:00