4b0c097dfd6d7c94b6288d49a216f57919982ea31f8dda97a1f62a21e7041435

Analysis

max time kernel
1800s
max time network
1606s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/05/2023, 17:13

Target

Main/Adobe AIR/Versions/1.0/Resources/Licenses/cairo/COPYING-LGPL-2.1
Size

26KB
MD5

86ce596bc517e1d7c5fe6149c75b1bdf
SHA1

01a50bc2cba30010116c6db30a2bce318a7a40de
SHA256

6f900e8acd64a5451373d39271cdb4ff55e073855574b0b1ad99a86c728545a5
SHA512

2d19f2cf7604a9f83784585afe36a90cf323d34708687b1f4df72b445438df6bd8d8d686a1f1e5fa6df7063a3942c1d061182360561c9dcf8fff1c9899695e75
SSDEEP

384:VjIBNk+x/vIq001qX6sT6AATeINgKP+nHQg1fgcmmItyOQeMvZrWEJZnjuo4:V0Bqs/qOTeDnXqFXOrlJZnjuo4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\1_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\1_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\1_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\1_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\1_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\.1	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\.1\ = "1_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\1_auto_file\shell\Read	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1216	908	cmd.exe	29
PID 908 wrote to memory of 1216	908	cmd.exe	29
PID 908 wrote to memory of 1216	908	cmd.exe	29
PID 1216 wrote to memory of 568	1216	rundll32.exe	30
PID 1216 wrote to memory of 568	1216	rundll32.exe	30
PID 1216 wrote to memory of 568	1216	rundll32.exe	30
PID 1216 wrote to memory of 568	1216	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Main\Adobe AIR\Versions\1.0\Resources\Licenses\cairo\COPYING-LGPL-2.1"
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Main\Adobe AIR\Versions\1.0\Resources\Licenses\cairo\COPYING-LGPL-2.1
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Main\Adobe AIR\Versions\1.0\Resources\Licenses\cairo\COPYING-LGPL-2.1"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:568

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact