c7dfa0f6dee10d33dd2b3e6437b49d7cf1fcffa4fd4057620fc996d9c3447c5a

Analysis

max time kernel
1558s
max time network
1559s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

waterfall.bat
Size

178B
MD5

333224bafb86f8a24fbbbdeeecba4209
SHA1

d416a869be968e2c9592918157a8620f875bedcf
SHA256

c7dfa0f6dee10d33dd2b3e6437b49d7cf1fcffa4fd4057620fc996d9c3447c5a
SHA512

24e652d26b0bb1fe4f89e93a3931edc8fe59514bc0dc5811539649dc6d43760f4d3841e23472572afc8d3e3efd4104a4532f1b34682b2df573500c34d92fb82f

Score

5^/10

ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Control Panel\Desktop\wallpaper = "C:\\Users\\Admin\\desktop\\fall.jpg"	reg.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2376	1924	cmd.exe	32
PID 1924 wrote to memory of 2376	1924	cmd.exe	32
PID 1924 wrote to memory of 2376	1924	cmd.exe	32
PID 1924 wrote to memory of 1520	1924	cmd.exe	33
PID 1924 wrote to memory of 1520	1924	cmd.exe	33
PID 1924 wrote to memory of 1520	1924	cmd.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\waterfall.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\control panel\desktop" /v wallpaper /t REG_SZ /d C:\Users\Admin\desktop\fall.jpg /f
  2⤵
  - Sets desktop wallpaper using registry
  PID:2376
- C:\Windows\system32\rundll32.exe
  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
  2⤵
  PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads