3ea350fa6916e36ba67a8a17a347bb89ab2567120eb9af4cf6648c1809711274

Analysis

max time kernel
1203s
max time network
856s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/07/2023, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d81c09d8249410587ae.zipai
Size

276B
MD5

8c0e14a1334daf7210742b170a13c7b8
SHA1

556b43c4ea47211a014174827dad142e656cd463
SHA256

3c1a69aed561a524ff9092a6366fdc2b33e0c91c1816a1dce1b70dc7c432555b
SHA512

6c68280530b9ed7d180cb0f228ab4efb776c052ff9d4478308cb2b6057d0ece284f245a8bf4d1509251dd5f320ad03c1633f7e48c8ab2e24b747c63126eabb09

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipai_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\.zipai	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\.zipai\ = "zipai_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipai_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipai_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipai_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipai_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipai_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2904	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2904	AcroRd32.exe
2904	AcroRd32.exe
2904	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2880	2276	cmd.exe	29
PID 2276 wrote to memory of 2880	2276	cmd.exe	29
PID 2276 wrote to memory of 2880	2276	cmd.exe	29
PID 2880 wrote to memory of 2904	2880	rundll32.exe	30
PID 2880 wrote to memory of 2904	2880	rundll32.exe	30
PID 2880 wrote to memory of 2904	2880	rundll32.exe	30
PID 2880 wrote to memory of 2904	2880	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipai
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipai
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipai"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fd9f0edd5e886514dbd3638f49803839

SHA1
fd4b9f07964fde09931488795aaf9482ef2ab3ea

SHA256
480ff220c4637d8d5935c8b6d649f0694c08df5ecd0c02f490a0f8657ec7223a

SHA512
aa53f4ed6a682050cf431b16e7bbb970ae2e473b0e2ba70750306bb0b8d70adf02d6e04206ab13bdb96bd8de928b951bd593831026b5ad8d2a75556f6e0e18de

Download Submit