ec27626fe895f819d7e713e26452947e646e152964f43dfc629aec1b6406c70a

Analysis

max time kernel
82s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10/07/2023, 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

leading.7z
Size

71.0MB
MD5

d0200d5121aeee62b2c10b2dbb12d2df
SHA1

7d1013f2756e27e710a698e25e2f1daba46bd418
SHA256

ec27626fe895f819d7e713e26452947e646e152964f43dfc629aec1b6406c70a
SHA512

d90bdb675c33610c66e87e914d33bdd2c01c3880d5149454f326a167f8e8de0aa610fb92a0e205d0fe79807f4d57a3e736ee0e35e3fee0eb8ed151a29e284434
SSDEEP

1572864:1fKH64k+FBdIxSDo+ERfSvz8syZHwAOCcjcBh7wq4aGnJhdKobOxIU9/:1fKa4kKdIRRK7yZHwAObcv1GJTuxIU

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\.7z\ = "7z_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\.7z	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2404	AcroRd32.exe
2404	AcroRd32.exe
2404	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1848	2060	cmd.exe	30
PID 2060 wrote to memory of 1848	2060	cmd.exe	30
PID 2060 wrote to memory of 1848	2060	cmd.exe	30
PID 1848 wrote to memory of 2404	1848	rundll32.exe	31
PID 1848 wrote to memory of 2404	1848	rundll32.exe	31
PID 1848 wrote to memory of 2404	1848	rundll32.exe	31
PID 1848 wrote to memory of 2404	1848	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\leading.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\leading.7z
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\leading.7z"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
88b60017370e76715195f099e1e425ab

SHA1
0697748710395f58a26c55b9baf186dd08ae3e89

SHA256
441d8d7f2b2cb2bb048f726ef2ce7586ce594797c852296f5931600e249a0a9e

SHA512
5074dcaf5b688ff68b984776e21fb3359e5d9545ba5facc105d3ffc09a626285c3e808e369998001998f4f021cc85e2ad5b8bc6c3524c842100b7f4a27f09778

Download Submit