9054f8ab24a39a7985d9b2354c146f95fa6faaddca34d18b106f30790c58451f

Analysis

max time kernel
150s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05/07/2023, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3a5c8e9195163cef8e0e70bd8f3d49c8048e37af7c969341e1753aee63df0ae.zip.7z
Size

25KB
MD5

15ab5294d46d542982a1b6beb625314b
SHA1

4da9ffaefeca64e4ab4e5c6dc259c2ab7bfeab5d
SHA256

9054f8ab24a39a7985d9b2354c146f95fa6faaddca34d18b106f30790c58451f
SHA512

1b19464fa57b28c9213d260a07728d5058679318cd961369d83b6fe3ffb2f18a8a7849a61c389999c5a797150799b3b4c7d1e637d923c5431c47b8d53c4b2b47
SSDEEP

768:f7EQAJkPV48jvXDWtjrDws+O8nROAjUcwpmJdLP:fZASPC8jfDWpnl+O8nRO3S9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\.7z\ = "7z_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\7z_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\7z_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\7z_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\7z_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\.7z	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\7z_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\7z_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1888	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1888	AcroRd32.exe
1888	AcroRd32.exe
1888	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 1096	2364	cmd.exe	30
PID 2364 wrote to memory of 1096	2364	cmd.exe	30
PID 2364 wrote to memory of 1096	2364	cmd.exe	30
PID 1096 wrote to memory of 1888	1096	rundll32.exe	31
PID 1096 wrote to memory of 1888	1096	rundll32.exe	31
PID 1096 wrote to memory of 1888	1096	rundll32.exe	31
PID 1096 wrote to memory of 1888	1096	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\c3a5c8e9195163cef8e0e70bd8f3d49c8048e37af7c969341e1753aee63df0ae.zip.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\c3a5c8e9195163cef8e0e70bd8f3d49c8048e37af7c969341e1753aee63df0ae.zip.7z
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c3a5c8e9195163cef8e0e70bd8f3d49c8048e37af7c969341e1753aee63df0ae.zip.7z"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4e5674f761652abc3f32ed8cd7273a39

SHA1
ac716f8b6de1b6c7be37ce4157164b8c176793dd

SHA256
0d16973e02ab2bf8802d11209a55467b10eaffd3ed2564ae349c4a0116dd8d28

SHA512
8d7eaad8f5533a89cb3aca211fbf2a581e2d21f672c283e5b901c160fa93e3b67b452d5fbdd0413173784bd5dc68ab6d08049da3b1e9c0ac21be34786c4c646b

Download Submit