30c4ed4509726173dfbb176a35e6cbc70b97cc7cad46c615e8bf89ad653b9ce6

Analysis

max time kernel
882s
max time network
884s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-05-2023 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

A2-Cryptor.cmd
Size

32KB
MD5

e031c713842d1db79d96101f8c0cf523
SHA1

f97ce721472dd931998b272eeeec4e31cfedbfa5
SHA256

30c4ed4509726173dfbb176a35e6cbc70b97cc7cad46c615e8bf89ad653b9ce6
SHA512

a97a688c0663d2937377eb379da4e5cbdea9b28d09611a634b66cfb251091890722d160b44154fe073c4a5eb89b5dee27f06e17b0b3aea96b2bab8ef03d5360e
SSDEEP

768:5yZE+8xnU25JWrmk2g9Ta1wCvKinXKCuY:5tU25J+a1hvhaCP

Score

6^/10

ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\A:	cmd.exe
File opened (read-only)	\??\B:	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\18769_25985.jpeg"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\18769_25985.jpeg"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\18769_25985.jpeg"	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 5 IoCs

evasion

pid	Process
1876	timeout.exe
1484	timeout.exe
1472	timeout.exe
1684	timeout.exe
320	timeout.exe

Modifies Control Panel 3 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Desktop	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Desktop	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Desktop	wscript.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 976	2040	cmd.exe	29
PID 2040 wrote to memory of 976	2040	cmd.exe	29
PID 2040 wrote to memory of 976	2040	cmd.exe	29
PID 2040 wrote to memory of 1684	2040	cmd.exe	30
PID 2040 wrote to memory of 1684	2040	cmd.exe	30
PID 2040 wrote to memory of 1684	2040	cmd.exe	30
PID 2040 wrote to memory of 320	2040	cmd.exe	31
PID 2040 wrote to memory of 320	2040	cmd.exe	31
PID 2040 wrote to memory of 320	2040	cmd.exe	31
PID 2040 wrote to memory of 1876	2040	cmd.exe	32
PID 2040 wrote to memory of 1876	2040	cmd.exe	32
PID 2040 wrote to memory of 1876	2040	cmd.exe	32
PID 2040 wrote to memory of 1484	2040	cmd.exe	33
PID 2040 wrote to memory of 1484	2040	cmd.exe	33
PID 2040 wrote to memory of 1484	2040	cmd.exe	33
PID 2040 wrote to memory of 1992	2040	cmd.exe	34
PID 2040 wrote to memory of 1992	2040	cmd.exe	34
PID 2040 wrote to memory of 1992	2040	cmd.exe	34
PID 2040 wrote to memory of 540	2040	cmd.exe	35
PID 2040 wrote to memory of 540	2040	cmd.exe	35
PID 2040 wrote to memory of 540	2040	cmd.exe	35
PID 2040 wrote to memory of 684	2040	cmd.exe	37
PID 2040 wrote to memory of 684	2040	cmd.exe	37
PID 2040 wrote to memory of 684	2040	cmd.exe	37
PID 2040 wrote to memory of 1472	2040	cmd.exe	36
PID 2040 wrote to memory of 1472	2040	cmd.exe	36
PID 2040 wrote to memory of 1472	2040	cmd.exe	36
PID 540 wrote to memory of 840	540	wscript.exe	38
PID 540 wrote to memory of 840	540	wscript.exe	38
PID 540 wrote to memory of 840	540	wscript.exe	38
PID 684 wrote to memory of 396	684	wscript.exe	39
PID 684 wrote to memory of 396	684	wscript.exe	39
PID 684 wrote to memory of 396	684	wscript.exe	39
PID 1992 wrote to memory of 1724	1992	wscript.exe	40
PID 1992 wrote to memory of 1724	1992	wscript.exe	40
PID 1992 wrote to memory of 1724	1992	wscript.exe	40
PID 2040 wrote to memory of 1564	2040	cmd.exe	41
PID 2040 wrote to memory of 1564	2040	cmd.exe	41
PID 2040 wrote to memory of 1564	2040	cmd.exe	41

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\A2-Cryptor.cmd"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\system32\certutil.exe
  certutil -decode "Image.bin" "18769_25985.jpeg"
  2⤵
  PID:976
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1684
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:320
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1876
- C:\Windows\system32\timeout.exe
  timeout /t 4
  2⤵
  - Delays execution with timeout.exe
  PID:1484
- C:\Windows\system32\wscript.exe
  wscript "0.vbs"
  2⤵
  - Sets desktop wallpaper using registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\System32\RUNDLL32.EXE
    "C:\Windows\System32\RUNDLL32.EXE" user32.dll, UpdatePerUserSystemParameters
    3⤵
    PID:1724
- C:\Windows\system32\wscript.exe
  wscript "0.vbs"
  2⤵
  - Sets desktop wallpaper using registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\System32\RUNDLL32.EXE
    "C:\Windows\System32\RUNDLL32.EXE" user32.dll, UpdatePerUserSystemParameters
    3⤵
    PID:840
- C:\Windows\system32\timeout.exe
  timeout /t 3
  2⤵
  - Delays execution with timeout.exe
  PID:1472
- C:\Windows\system32\wscript.exe
  wscript "0.vbs"
  2⤵
  - Sets desktop wallpaper using registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\System32\RUNDLL32.EXE
    "C:\Windows\System32\RUNDLL32.EXE" user32.dll, UpdatePerUserSystemParameters
    3⤵
    PID:396
- C:\Windows\system32\mode.com
  MODE CON: COLS=100 LINES=25
  2⤵
  PID:1564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact