2405d448a846ffd6969dee781d02f37d4523b71036ed8e1c414c3afe895560cc

General

Target

style_6_18_1624866734.gz

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\gz_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\gz_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\gz_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\gz_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\gz_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\.gz	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\.gz\ = "gz_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\gz_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2436 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2436 AcroRd32.exe
2436 AcroRd32.exe
2436 AcroRd32.exe

pid	process
2436	AcroRd32.exe

pid	process
2436	AcroRd32.exe
2436	AcroRd32.exe
2436	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2420 wrote to memory of 2396	2420	cmd.exe	rundll32.exe
PID 2420 wrote to memory of 2396	2420	cmd.exe	rundll32.exe
PID 2420 wrote to memory of 2396	2420	cmd.exe	rundll32.exe
PID 2396 wrote to memory of 2436	2396	rundll32.exe	AcroRd32.exe
PID 2396 wrote to memory of 2436	2396	rundll32.exe	AcroRd32.exe
PID 2396 wrote to memory of 2436	2396	rundll32.exe	AcroRd32.exe
PID 2396 wrote to memory of 2436	2396	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\style_6_18_1624866734.gz
1⤵
- Suspicious use of WriteProcessMemory
PID:2420

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\style_6_18_1624866734.gz
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2396

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\style_6_18_1624866734.gz"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2436

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
5ed0924c1c3143f1735b858a761126c8

SHA1
a85c25b7bce788a3feafedaef1700771ddb707fd

SHA256
8d32f7749e221fff9533886b99561103622015d3cf04f6d4d72dbfce2ad54c13

SHA512
14677ef62d6d29547be836c8be5e1515a9686ceae80f21030062eadeb89960b12fe87699515a7b13d4a9755b4ae922d27e932d24589cfd21a38b3b040cc8d0fd

Download Submit

Analysis

Sharing