5b3550ddc472474306f5302ee3ba2e4f8d4acfcf425ee202be9e22262ccb8b68

Analysis

max time kernel
8s
max time network
13s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-06-2023 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SEASON_DATA_CACHE.json
Size

86KB
MD5

5ddfd0499eeddd764f310a4d293dc0d7
SHA1

a51673644a0e8eaa2a644b726cacf70ac36da18e
SHA256

5b3550ddc472474306f5302ee3ba2e4f8d4acfcf425ee202be9e22262ccb8b68
SHA512

bc5f392fe3c3612d069c1f254c2ac0046468cec751e70eda99db280be9d1e155a741aa1908e026958101a03478fd5fe3ccc25e79e23d0214d93eefa2058a28f0
SSDEEP

768:CFWUwa00000000000000000+Pb1PbrPbBPbDPbz:CkUwa00000000000000000+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\json_auto_file\shell\edit	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\json_auto_file\shell\edit\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\json_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\json_auto_file\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\json_auto_file\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\json_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1148	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 664	1724	cmd.exe	29
PID 1724 wrote to memory of 664	1724	cmd.exe	29
PID 1724 wrote to memory of 664	1724	cmd.exe	29
PID 664 wrote to memory of 1148	664	rundll32.exe	30
PID 664 wrote to memory of 1148	664	rundll32.exe	30
PID 664 wrote to memory of 1148	664	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SEASON_DATA_CACHE.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SEASON_DATA_CACHE.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\SEASON_DATA_CACHE.json
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads