71b8e65d2b3d83388727a6af4e457c4339c7a6ed6aa1e05fac1f74e0c0c775c2

Analysis

max time kernel
150s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/03/2023, 23:22

Target

APT 37 Previous Commits 2/K-MOOC 수기 공모 이벤트.hwp
Size

819KB
MD5

96900e1e6090a015a893b7718d6295dd
SHA1

bf1b2325bf7796358c51a90573447e0eb534e728
SHA256

5267278ccda9d454ee0ab27a6e0688f1f2689ac7e5ef08c37ae53b39fc34155a
SHA512

e8166446949584f75600d5bc105c6298ffae232347dc28cc7a8c77a5556326b5ff35d13b387b22226a8ab3865c6c994c53afab007c5822363dacf7e9c3828c1f
SSDEEP

12288:g2tFqMA/GRa/OL5AvyyqvNjgwAXR9tFqMA/GRa/OL5AvyyqvNjg:jcvGRBVsy1vlDAXR3cvGRBVsy1vl

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\.hwp\ = "hwp_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\hwp_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\.hwp	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\hwp_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\hwp_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\hwp_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\hwp_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\hwp_auto_file\	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1124	2032	cmd.exe	29
PID 2032 wrote to memory of 1124	2032	cmd.exe	29
PID 2032 wrote to memory of 1124	2032	cmd.exe	29
PID 1124 wrote to memory of 1420	1124	rundll32.exe	30
PID 1124 wrote to memory of 1420	1124	rundll32.exe	30
PID 1124 wrote to memory of 1420	1124	rundll32.exe	30
PID 1124 wrote to memory of 1420	1124	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\APT 37 Previous Commits 2\K-MOOC 수기 공모 이벤트.hwp"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\APT 37 Previous Commits 2\K-MOOC 수기 공모 이벤트.hwp
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\APT 37 Previous Commits 2\K-MOOC 수기 공모 이벤트.hwp"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1420

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact