775e1297d7abf73894ef8d0733e5388f6c849ff96852dac42bfb20081c3aa75b

Analysis

max time kernel
152s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/05/2023, 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SIM Ver 2.1.0_BMS_LAST_TEST/3.SIM DBSchema_20210312/SIM DBSchema_20210312/exe/DBSchemaManager.exe.config
Size

1KB
MD5

da51aec6225b189fded69fca45bdf35e
SHA1

10d14b715d7ba9e6757147b3b699d983301b9464
SHA256

6697f1630514629e30531767ed9a3b8d23940fcc64855b856e1ca9b5eaf87237
SHA512

1c1c532caba5f54d2d5fb1584ee7974d44802b873530d4e2a4ec4b4f2e9b10041bb63c4e5edc79653c24fada2078e3141d28204d36eb07cc9a99aaa85756f9be

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
768	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
768	AcroRd32.exe
768	AcroRd32.exe
768	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 768	1976	cmd.exe	29
PID 1976 wrote to memory of 768	1976	cmd.exe	29
PID 1976 wrote to memory of 768	1976	cmd.exe	29
PID 1976 wrote to memory of 768	1976	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SIM Ver 2.1.0_BMS_LAST_TEST\3.SIM DBSchema_20210312\SIM DBSchema_20210312\exe\DBSchemaManager.exe.config"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SIM Ver 2.1.0_BMS_LAST_TEST\3.SIM DBSchema_20210312\SIM DBSchema_20210312\exe\DBSchemaManager.exe.config"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of SetWindowsHookEx
  PID:768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...