Analysis

  • max time kernel
    150s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    21-06-2023 11:25

General

  • Target

    carLambo/QULuOzqHXCcwKyTrdxVnN.class

  • Size

    5KB

  • MD5

    c648ff3be6862d06c018c9c857843713

  • SHA1

    8d009a762601efd30a63013a610568dbf42386f9

  • SHA256

    73f50ab830091397192545c9abc9a40d6cb25ffda561b7c2407d7011566423ad

  • SHA512

    29fbadea9edf92d46f9e726aa881325d2b474e4a841bf4e2e93d63c67a9622dd5490952b2e47c20f7ddbec347e0044dd16b8ee278410043a2a9eff58185acb1c

  • SSDEEP

    96:dmryXPjKfnO+MxKM1D0kZ6E8cp0h5dOENZai99jxF8flNMxlcbVPCxIwT:wrSLsjFM1DuPcU5tNZR9VxSlVEIwT

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\carLambo\QULuOzqHXCcwKyTrdxVnN.class
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\carLambo\QULuOzqHXCcwKyTrdxVnN.class
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\carLambo\QULuOzqHXCcwKyTrdxVnN.class"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:1760

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    9bc5604b0a753905e167825d014f2751

    SHA1

    b03dabe31969d753b117eb8a57a302b94a968b85

    SHA256

    f0e2804b447e30de41f62be73165b7316a6561f25e004ba21d76c8b44ed5dfa2

    SHA512

    23301e22edbf4d215f442f615fa6e3cfebfe975d7d30f6e8ad99e422de67bb7f9140f48e6723a14e8f1daae116442420004b54ca7dca479ae014848d31b13abf