baed724c96e43f0321a996043a16e0a7d87788665b202c47f43924c3e4601896

Analysis

max time kernel
1800s
max time network
1594s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/04/2023, 16:53

Target

215C68934E66ADC48AD67F59B086194DA8C1393E.torrent
Size

31KB
MD5

3afb2e5c48d0f89ca985ae4cc3be6840
SHA1

036bf14bdf98456da2857077a69827fe09125c60
SHA256

baed724c96e43f0321a996043a16e0a7d87788665b202c47f43924c3e4601896
SHA512

00f0bba701e32060f93f1a5feec808b689a57d2267271d39096790e7c9241d859cafe9cc2eb9a0f78580d7f24db1e63b2d41ea241dd217073077c4b717545ac7
SSDEEP

384:wMawDrs4uqIumOms5cKEMuFts0S+5L9LFw4qiV1NKXkfjHIYiJxLf3L7B8WJaoxu:+b1ni33L9VJaoyJVuT2XSzMhH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\torrent_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\.torrent	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\.torrent\ = "torrent_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\torrent_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\torrent_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\torrent_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\torrent_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\torrent_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1484	1388	cmd.exe	29
PID 1388 wrote to memory of 1484	1388	cmd.exe	29
PID 1388 wrote to memory of 1484	1388	cmd.exe	29
PID 1484 wrote to memory of 524	1484	rundll32.exe	30
PID 1484 wrote to memory of 524	1484	rundll32.exe	30
PID 1484 wrote to memory of 524	1484	rundll32.exe	30
PID 1484 wrote to memory of 524	1484	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\215C68934E66ADC48AD67F59B086194DA8C1393E.torrent
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\215C68934E66ADC48AD67F59B086194DA8C1393E.torrent
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\215C68934E66ADC48AD67F59B086194DA8C1393E.torrent"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:524

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact