3ea350fa6916e36ba67a8a17a347bb89ab2567120eb9af4cf6648c1809711274

Analysis

max time kernel
1201s
max time network
857s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/07/2023, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d81c09d8249410587ae.zipaj
Size

276B
MD5

0981763686ccbaeb328f9bf85101200e
SHA1

b0a27789929af7db6bc3da5e7ae7571e39b7fd76
SHA256

cfa87f6afd5ccff85a0220a4509b26150a0b6f0538c8ffc1623a9b9a4feb2684
SHA512

2655fce811abf8417a79e325bfd3f7dd022aa3a05610342f623a048cb132fc4ca5f15cb64cdfa5501b13da98c105f55e6a4b4e212af55e5e9efc4d68f9e178dc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\zipaj_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\zipaj_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\zipaj_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\zipaj_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.zipaj	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.zipaj\ = "zipaj_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\zipaj_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\zipaj_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1876	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1876	AcroRd32.exe
1876	AcroRd32.exe
1876	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2728	2908	cmd.exe	29
PID 2908 wrote to memory of 2728	2908	cmd.exe	29
PID 2908 wrote to memory of 2728	2908	cmd.exe	29
PID 2728 wrote to memory of 1876	2728	rundll32.exe	30
PID 2728 wrote to memory of 1876	2728	rundll32.exe	30
PID 2728 wrote to memory of 1876	2728	rundll32.exe	30
PID 2728 wrote to memory of 1876	2728	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipaj
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipaj
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipaj"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
be9b193910188e4cba3178c61256fbc3

SHA1
5ba769851fefb887bb3c08a4a56b9a5548f5afc3

SHA256
d11a4b865b69005cffb0b608b43a1f22e31ce2c4287c1b305328ca51b79fa21e

SHA512
2e662efcf3eefc1e9a03d3cdf5e386f4efee730dde754bb300815adae97c32dcd0c55d302ae9c47d1981e1fb0ef40b2dcf964ccad4b002a556517e3e8010561b

Download Submit