986c071feabb74f5805428203a84f7bc08df4812de0c32aeda063f4793bafd13

Resubmissions

10-05-2023 15:05

230510-sf581sad3x 1

10-05-2023 15:04

230510-sfnnzaad3t 3

Analysis

max time kernel
150s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-05-2023 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/changetoken.plist
Size

605B
MD5

7a084ebe1060dbe4550bbdd6648952fc
SHA1

39a2b30cfad21a4b70ba53c81a38efb6b793e6b1
SHA256

fe6f00cf7982c6f135d6dd91e932248dc8f1f2b7af146b7988316d5a344d6d9d
SHA512

ad7ce6f75d9b6094dc92769f83efdeb81a03e9c9b43586e585e3935e0364e5494ba4c508617c5a99918ad1f06dcce39305c506cf6d481a789793f26224646f59

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\plist_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\plist_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\plist_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.plist\ = "plist_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\plist_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.plist	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\plist_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\plist_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
688	AcroRd32.exe
688	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 268	1520	cmd.exe	28
PID 1520 wrote to memory of 268	1520	cmd.exe	28
PID 1520 wrote to memory of 268	1520	cmd.exe	28
PID 268 wrote to memory of 688	268	rundll32.exe	29
PID 268 wrote to memory of 688	268	rundll32.exe	29
PID 268 wrote to memory of 688	268	rundll32.exe	29
PID 268 wrote to memory of 688	268	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Photos Library.photoslibrary\private\com.apple.photoanalysisd\caches\graph\changetoken.plist"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Photos Library.photoslibrary\private\com.apple.photoanalysisd\caches\graph\changetoken.plist
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Photos Library.photoslibrary\private\com.apple.photoanalysisd\caches\graph\changetoken.plist"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads