8352abaefabf7e4d8f07059c74677ea1645cdb69def14f219230e845c4e2c908

Analysis

max time kernel
163s
max time network
110s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/05/2023, 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Halo (1749 2001-08-15)/maps/wizard.map
Size

15.3MB
MD5

bf4134cae12fb773660800753eb16eae
SHA1

919ab44f5df5030724bac79eb3d31db3dc8b2fc8
SHA256

b47fa1b9d001282c22cfe719e66cee154ed965ed7d72790660b9b88eddce263d
SHA512

aeca9eb9f9466a47846c4519e1086c98d555710d957c6b7ab84d29d57e6ef637f0316aa29f50aed42bb5320c1c36f4a4b0181eba9b111d93e202d7fe3142eb2c
SSDEEP

393216:IpgZhhOnDH1jxl4OuFRd0Q2mvDv0midWnQVKDZ6o8kD/K3Kd:IpwMDVcdHvr0meWN6olDi3y

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.map\ = "map_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\map_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\map_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\map_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\map_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\map_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\map_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.map	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1260	AcroRd32.exe
1260	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 600	1704	cmd.exe	28
PID 1704 wrote to memory of 600	1704	cmd.exe	28
PID 1704 wrote to memory of 600	1704	cmd.exe	28
PID 600 wrote to memory of 1260	600	rundll32.exe	29
PID 600 wrote to memory of 1260	600	rundll32.exe	29
PID 600 wrote to memory of 1260	600	rundll32.exe	29
PID 600 wrote to memory of 1260	600	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Halo (1749 2001-08-15)\maps\wizard.map"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Halo (1749 2001-08-15)\maps\wizard.map
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Halo (1749 2001-08-15)\maps\wizard.map"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...