4b0c097dfd6d7c94b6288d49a216f57919982ea31f8dda97a1f62a21e7041435

Analysis

max time kernel
1594s
max time network
1600s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-05-2023 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Main/Adobe AIR/Versions/1.0/Adobe AIR.dll
Size

18.8MB
MD5

8b0a08e93f8f1e2d9b6104e4aa311b61
SHA1

f64ab4cceb35b417d2fd22b76b560200285845f8
SHA256

dbac4ac4f44495d6d432cb8d05d070e890ed999d23a8e948718164a4fab726fa
SHA512

9a6264edb48a9ef6ce48197d02a9b5c5de6ee848a9ce570166a92361bf625218250f45fa81f1d3e8b2f6ef08a43f8817c6ede5f35f570a6870d1487a856c099e
SSDEEP

393216:3A3w+OZTGsE245/hpJSG/efFNaovjztrZi:ssEhafFNaovjpZi

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1152	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Main\Adobe AIR\Versions\1.0\Adobe AIR.dll",#1
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-135-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download