99dda908d9a3c3e697a9b2a42b765ca60ae5b404ffb651312ac8e2ddab9ef9fc

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sources/calcpnfentropy.cpp
Size

7KB
MD5

de10453ebc94969450895aa7ec62ded7
SHA1

3bc962b78c8e9577397cbdb596ea1d74e965013d
SHA256

5a4b57fd9dc24174cce5058c6fdeeac3459fc7458adb2ab15e64a8fb4167e4a2
SHA512

8368d9a8ced569c025dc0a8f6bde0fd78d1136d81fbac96eceb6663b316efe80c764c2650ade9a4df747927a905afb7ad71309631e9a840c9b33f5a1e2d1a29a
SSDEEP

192:AkP7Khvz4QCwqfd+CmS2Lef2obq29UU6+2vpZQ2p3d:kQGsUz

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cpp_auto_file\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cpp_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\.cpp	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cpp_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cpp_auto_file\shell\edit\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cpp_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cpp_auto_file\shell\open	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cpp_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cpp_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\.cpp\ = "cpp_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cpp_auto_file\shell\edit	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2832	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 2732	1436	cmd.exe	29
PID 1436 wrote to memory of 2732	1436	cmd.exe	29
PID 1436 wrote to memory of 2732	1436	cmd.exe	29
PID 2732 wrote to memory of 2832	2732	rundll32.exe	30
PID 2732 wrote to memory of 2832	2732	rundll32.exe	30
PID 2732 wrote to memory of 2832	2732	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sources\calcpnfentropy.cpp
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\sources\calcpnfentropy.cpp
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\sources\calcpnfentropy.cpp
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...