ff7e43e4086d0c705071cebe436b390038c26c817f02d80b1f8e8aa5b7112c52

Analysis

max time kernel
126s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2023, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Funny file/Screenshot_20210212-081709_Snapchat.jpg
Size

512KB
MD5

33158e7e9fb24dea70e1a3418f76981b
SHA1

d30074c9ae70ae01462470cfd3aadd1cad837312
SHA256

ae4cc248cea0d2b506e3959f68dc6b45c4ed5a476e83f91c029c71af5d3a0ca8
SHA512

f4da028ae233581047417a0c838ca36be965c346a939102f60fb9a5335fc1140afb5023f68f4df06a6bac531f66fe1a243df97f61e76abce356998f1081ab1ab
SSDEEP

12288:HagWLqdUhYqlwb+jr8czu48dk3fA7W2OhR/3LkcSYy:HvWLMUhYQMi5XP2Ob/3L9SL

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	mspaint.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2320	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1800	mspaint.exe
1800	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1096	OpenWith.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1800	mspaint.exe
1096	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Funny file\Screenshot_20210212-081709_Snapchat.jpg"
1⤵
PID:4696

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2010_x64.log-MSI_vc_red.msi.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2320

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4072

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Funny file\Screenshot_20210212-081709_Snapchat.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4156-133-0x0000028830350000-0x0000028830360000-memory.dmp

Filesize
64KB

Download
memory/4156-137-0x0000028830390000-0x00000288303A0000-memory.dmp

Filesize
64KB

Download
memory/4156-144-0x0000028838FE0000-0x0000028838FE1000-memory.dmp

Filesize
4KB

Download
memory/4156-146-0x0000028839060000-0x0000028839061000-memory.dmp

Filesize
4KB

Download
memory/4156-148-0x0000028839060000-0x0000028839061000-memory.dmp

Filesize
4KB

Download
memory/4156-149-0x00000288390F0000-0x00000288390F1000-memory.dmp

Filesize
4KB

Download
memory/4156-150-0x00000288390F0000-0x00000288390F1000-memory.dmp

Filesize
4KB

Download
memory/4156-151-0x0000028839100000-0x0000028839101000-memory.dmp

Filesize
4KB

Download
memory/4156-152-0x0000028839100000-0x0000028839101000-memory.dmp

Filesize
4KB

Download