3e2ba9a25e9891c6dcb75ad73c1262d523e09f0eb3d095ede9ea9d11f42ebc28

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-11-2024 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ransomware-master/etc/load.sh
Size

4KB
MD5

8f14e34971812277edeb8a31376cb27a
SHA1

5a96858d0d97ca1e229a1270d1a34a09c3c677ea
SHA256

1a275cbf23a5a5620d40cda6bd3f621a48d7b2119b2c8bf97b87a97f83933e85
SHA512

a63a692e0d63944ee9824578b52f7eb41fd9d9f7e3414d22cb3b81f337571f0c8720672866f4f534eb1c7f3c87662b120addff038806363f3ccaf86a69949ca4
SSDEEP

96:v7fGWJIKNsm/kgrkSYpJhc0P+Z6psE8Gkh+mKuc3nWX5neEpT2:vbdp1fY3hlaG1kh+mjcm4EU

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

AcroRd32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

rundll32.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid	Process
2880	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid	Process
2880	AcroRd32.exe
2880	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	Process	procid_target
PID 1924 wrote to memory of 2248	1924	cmd.exe	32
PID 1924 wrote to memory of 2248	1924	cmd.exe	32
PID 1924 wrote to memory of 2248	1924	cmd.exe	32
PID 2248 wrote to memory of 2880	2248	rundll32.exe	33
PID 2248 wrote to memory of 2880	2248	rundll32.exe	33
PID 2248 wrote to memory of 2880	2248	rundll32.exe	33
PID 2248 wrote to memory of 2880	2248	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\load.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\load.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\load.sh"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6a0e30ffa8311f0f499c0963dbd25138

SHA1
e8ab85c0a943f6b59775a343374cd7c22d3769df

SHA256
1f88fc18b9ee5672baf95815c344320a079727c47c5c67052c8052459e693b0c

SHA512
a2a223a76c907c1bcb95512c69c1618f534382a4ae4397d5b399afbca8b7004424fbf67331af7ccca0fd3f833c860e959983bf074c952205db7326a235193816

Download Submit