Analysis

  • max time kernel
    150s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    21-06-2023 11:25

General

  • Target

    carLambo/HBrowserNativeApis.class

  • Size

    4KB

  • MD5

    37c626e65556250e1f4aa28f13f50ec6

  • SHA1

    ee3e78187da5c39b74b1533d4d9ccdc3d9f6a81b

  • SHA256

    aaa4e40550968e043121b557d06685abe8c04f7e2e0407d89626641615dec902

  • SHA512

    29f0ed02c33cad8529901f16837cb100738a79c74c5e3d70721720b7b8cd540d3acf4a2183bd57ad4890d8857a329e0a3237c4b2b3d26346823c91609ea8cedd

  • SSDEEP

    96:m7+cJ4rh4i/H5zhKp9wFWmWYaouGF/jE7:Hq4J/HtUPdmTahGVjk

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\carLambo\HBrowserNativeApis.class
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\carLambo\HBrowserNativeApis.class
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:272
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\carLambo\HBrowserNativeApis.class"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:572

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    aab00ee5888bd4e50a3035948405b9a5

    SHA1

    238e5c2369ce87aacb0497b85b8577397f154a82

    SHA256

    9f487bb70dadc090b25c95c37b3b97dcd83dd050383235b25847503bc999211f

    SHA512

    d46329467122ec7be19fd4ff93dfd5bdddf71f93276fa2f4dbd2723f8a1e538278e65538ce6a1c99347fa566e497bca5f8d77ff55396d5c67541cade656b1107