71b8e65d2b3d83388727a6af4e457c4339c7a6ed6aa1e05fac1f74e0c0c775c2

Analysis

max time kernel
165s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/03/2023, 23:22

Target

APT 37 Previous Commits 2/(227183-F)_사업진행상태보고서.hwp
Size

63KB
MD5

808fda00b7aa114182ba0ad9668ad4fb
SHA1

43dd539bd2a45be5d02827b60d51c38a907fb5b6
SHA256

7314761f3fab40295fe7d3a3d8bb4588516661011c2e095473837914af1b3169
SHA512

33b4a694b4f11f9ee99836bdb441836caa246bb88da0792996602462d409172078e266c439e75c0ff5883b12185bd020357bc5d26428dc7296e6bb8f208a5895
SSDEEP

1536:lUma8yLwcTOSfWv2LV/NuT0KQcClOM1Fpbvt4Q/zqCNq7rH:lA8JcTRtXKXClvrqQ/PI/H

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\hwp_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\hwp_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\hwp_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\hwp_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\.hwp	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\.hwp\ = "hwp_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\hwp_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\hwp_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
596	AcroRd32.exe
596	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1476	1956	cmd.exe	29
PID 1956 wrote to memory of 1476	1956	cmd.exe	29
PID 1956 wrote to memory of 1476	1956	cmd.exe	29
PID 1476 wrote to memory of 596	1476	rundll32.exe	30
PID 1476 wrote to memory of 596	1476	rundll32.exe	30
PID 1476 wrote to memory of 596	1476	rundll32.exe	30
PID 1476 wrote to memory of 596	1476	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\APT 37 Previous Commits 2\(227183-F)_사업진행상태보고서.hwp"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\APT 37 Previous Commits 2\(227183-F)_사업진행상태보고서.hwp
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\APT 37 Previous Commits 2\(227183-F)_사업진행상태보고서.hwp"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:596

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact