8f75e0958f99e96dc69b2e13d5a51b1faf03fb3224d8ab072997e3007c9940c3

Analysis

max time kernel
150s
max time network
31s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10/07/2023, 21:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Yarbrough/Mk2Y/Assets/DiffuseWindow1.dds
Size

341KB
MD5

d12e7f004a3e144fd2c0f00bf9531134
SHA1

ba1b9acecaff9666433793a0732951999d312cae
SHA256

b4c7699cb6e64cbfebd593fd211e0d6b5076c4b8e9ac213a163265e7ea987b77
SHA512

5241f04b8f52e87635a5814269fda16c10df502f92e97d12ca67dad80cf0e77b8ed4406097e9173383ab5f474a159945d6b928638e70be93d870641b1d5ac312
SSDEEP

3072:xC/SO8gKnMiyiTRTDdEWXYte/V3esVdTY4C7YwoAViI1O6nkQ6T92MsXLWIkfV6O:xgqg1KVdEWog8fj7YjATn8TwZyQNU

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\.dds\ = "dds_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\dds_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\.dds	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\dds_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\dds_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\dds_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\dds_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\dds_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
584	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
584	AcroRd32.exe
584	AcroRd32.exe
584	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2392	3008	cmd.exe	30
PID 3008 wrote to memory of 2392	3008	cmd.exe	30
PID 3008 wrote to memory of 2392	3008	cmd.exe	30
PID 2392 wrote to memory of 584	2392	rundll32.exe	31
PID 2392 wrote to memory of 584	2392	rundll32.exe	31
PID 2392 wrote to memory of 584	2392	rundll32.exe	31
PID 2392 wrote to memory of 584	2392	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Yarbrough\Mk2Y\Assets\DiffuseWindow1.dds
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Yarbrough\Mk2Y\Assets\DiffuseWindow1.dds
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Yarbrough\Mk2Y\Assets\DiffuseWindow1.dds"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d616b5bfd8ea13bcf7e7a4a8149dadb6

SHA1
0d167569643db6517fd675df055adf4e9e2341e4

SHA256
61c6458d3083d912cedf2c7997cd7dd9bfad9d6890c102aa818b661b72bf4e4f

SHA512
8422bd4eea1aceaa6a901aaa0da6ed262d3878787de7c7741f7519d74b8a460121a5a951f9d21b38cf4158bc74a42b07f13e4d9cb5329d8b868108778289bb3b

Download Submit