ec27626fe895f819d7e713e26452947e646e152964f43dfc629aec1b6406c70a

Analysis

max time kernel
82s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10-07-2023 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

leading.7z
Size

71.0MB
MD5

d0200d5121aeee62b2c10b2dbb12d2df
SHA1

7d1013f2756e27e710a698e25e2f1daba46bd418
SHA256

ec27626fe895f819d7e713e26452947e646e152964f43dfc629aec1b6406c70a
SHA512

d90bdb675c33610c66e87e914d33bdd2c01c3880d5149454f326a167f8e8de0aa610fb92a0e205d0fe79807f4d57a3e736ee0e35e3fee0eb8ed151a29e284434
SSDEEP

1572864:1fKH64k+FBdIxSDo+ERfSvz8syZHwAOCcjcBh7wq4aGnJhdKobOxIU9/:1fKa4kKdIRRK7yZHwAObcv1GJTuxIU

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\.7z\ = "7z_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\.7z	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2404 AcroRd32.exe
2404 AcroRd32.exe
2404 AcroRd32.exe

pid	process
2404	AcroRd32.exe
2404	AcroRd32.exe
2404	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2060 wrote to memory of 1848	2060	cmd.exe	rundll32.exe
PID 2060 wrote to memory of 1848	2060	cmd.exe	rundll32.exe
PID 2060 wrote to memory of 1848	2060	cmd.exe	rundll32.exe
PID 1848 wrote to memory of 2404	1848	rundll32.exe	AcroRd32.exe
PID 1848 wrote to memory of 2404	1848	rundll32.exe	AcroRd32.exe
PID 1848 wrote to memory of 2404	1848	rundll32.exe	AcroRd32.exe
PID 1848 wrote to memory of 2404	1848	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\leading.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\leading.7z
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1848

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\leading.7z"
3⤵
- Suspicious use of SetWindowsHookEx
PID:2404

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
88b60017370e76715195f099e1e425ab

SHA1
0697748710395f58a26c55b9baf186dd08ae3e89

SHA256
441d8d7f2b2cb2bb048f726ef2ce7586ce594797c852296f5931600e249a0a9e

SHA512
5074dcaf5b688ff68b984776e21fb3359e5d9545ba5facc105d3ffc09a626285c3e808e369998001998f4f021cc85e2ad5b8bc6c3524c842100b7f4a27f09778

Download Submit