Resubmissions
30-04-2024 21:32
240430-1dsh5sgb5w 1026-12-2023 17:34
231226-v5wrzsabgn 1013-12-2023 16:11
231213-tmycesfacp 10Analysis
-
max time kernel
122s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
30-04-2024 21:32
Static task
static1
agilenetguloaderloaderinfostealerratminerrezer0ransomwarepdflinkdropperbackdoor888ratguloadericedidloaderbotm00nd3v_loggermatiexnetwiresnakekeyloggerxmrigardamaxevilnumlegionlockermassloggerteardropgrowtopiametasploitnanocore
37 signatures
Behavioral task
behavioral1
Sample
be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0.dll
Resource
win7-20240419-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0.dll
-
Size
154.8MB
-
MD5
9dae649039736ebce04c0a381f64e0fe
-
SHA1
f50767804a693308e5e907bc22fa4c13e7ffb9cf
-
SHA256
be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0
-
SHA512
d1e213b944a1cd9524f09ee4f723fba82eb6f2d8f74e49f6a0ca37603d82ad0eb398df283ee881b8c4d28c541b2ecda665aea715f36022804c4422bf7ad75e33
-
SSDEEP
786432:+xht4Uz95Mqkwog0cm9K7W1WrPVEZOgFQww9M2CCSY9H0suLsqZZ:MOQogrm473rPVE0Pdq2CCNDYbZZ
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\svgz_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\svgz_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\svgz_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\svgz_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.svgz rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.svgz\ = "svgz_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\svgz_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\svgz_auto_file\shell rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2700 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1860 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1860 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe 1860 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 800 AcroRd32.exe 800 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2520 wrote to memory of 800 2520 rundll32.exe 35 PID 2520 wrote to memory of 800 2520 rundll32.exe 35 PID 2520 wrote to memory of 800 2520 rundll32.exe 35 PID 2520 wrote to memory of 800 2520 rundll32.exe 35
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\be240429f6a9f67df22429d9fac5c22c887a65dae26f0af0b705ada8b61060c0.dll,#11⤵PID:1612
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1860
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\WaitRedo.ps1xml1⤵
- Opens file in notepad (likely ransom note)
PID:2700
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\UndoOpen.svgz1⤵
- Modifies registry class
PID:2660
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\UndoOpen.svgz1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\UndoOpen.svgz"2⤵
- Suspicious use of SetWindowsHookEx
PID:800
-