40aea896fbc6a5b560f9c16a93e055dfeaad7e628b429f4b73143f22443877dc

Analysis

max time kernel
149s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/05/2023, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

googleupdate.a3x
Size

133KB
MD5

84a5746202decee74d907a37015a01d4
SHA1

872b8d1f2269e645237bb8303ea96012482f9fc2
SHA256

97549d52f601a27b336660e8d4983ba10504e371162c64b36077a7670ca0d032
SHA512

aff2a5ba7758dd6116178679f34689d94fcf8b4589bb039935f96531bf7787a8e8435913ae4c6dd45c386d82f966e25e3b6ff8c765744b95009300f307f73134
SSDEEP

3072:QuNSBBCTqhjAhnOazEDzyEXIq8+Uolv0xB3KsXus5TNjGJ:p0BBMuonOyE/MslvaJBtQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\a3x_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\a3x_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.a3x	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.a3x\ = "a3x_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\a3x_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\a3x_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\a3x_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\a3x_auto_file\	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1688	AcroRd32.exe
1688	AcroRd32.exe
1688	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 564	924	cmd.exe	28
PID 924 wrote to memory of 564	924	cmd.exe	28
PID 924 wrote to memory of 564	924	cmd.exe	28
PID 564 wrote to memory of 1688	564	rundll32.exe	29
PID 564 wrote to memory of 1688	564	rundll32.exe	29
PID 564 wrote to memory of 1688	564	rundll32.exe	29
PID 564 wrote to memory of 1688	564	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\googleupdate.a3x
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\googleupdate.a3x
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\googleupdate.a3x"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...