3ea350fa6916e36ba67a8a17a347bb89ab2567120eb9af4cf6648c1809711274

Analysis

max time kernel
1202s
max time network
854s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/07/2023, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d81c09d8249410587ae.zipag
Size

276B
MD5

e367383a5ed014fd12fb5140a8a151bf
SHA1

848ac4f3be866e4c1a49f21330aad60b83dd37c8
SHA256

60e87d23187749b46fd5a0a01d1a2a083440767ad3205da4a2951aca5037ac37
SHA512

7e55d498fb71d4938be6f1c4ac1d09a677647b342ae48382244946825eea53fad785e627e8805949817ce7c98e69a49750766cf5f02befc0996bf2c752a1ecb7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\zipag_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\zipag_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.zipag	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\zipag_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.zipag\ = "zipag_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\zipag_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\zipag_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\zipag_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2276	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2276	AcroRd32.exe
2276	AcroRd32.exe
2276	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2076	2236	cmd.exe	29
PID 2236 wrote to memory of 2076	2236	cmd.exe	29
PID 2236 wrote to memory of 2076	2236	cmd.exe	29
PID 2076 wrote to memory of 2276	2076	rundll32.exe	32
PID 2076 wrote to memory of 2276	2076	rundll32.exe	32
PID 2076 wrote to memory of 2276	2076	rundll32.exe	32
PID 2076 wrote to memory of 2276	2076	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipag
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipag
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipag"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
849a2f5fe4256adf5500b241a14b870a

SHA1
766bda994e93d3818316d549e9b50d32125a43bd

SHA256
b3d19af0b67e9366c747d2d9ad960a8a4a6f7306283f27a4456bbab42e7485d3

SHA512
097bab966ee2cc6516c615bed93547c585b5d0818daf68af560b5bb813bf8843fc5cfbfd6e97677376981ba81199c35b166d0ba63e3bcc8f5ce9896fdc49ae7b

Download Submit