3ea350fa6916e36ba67a8a17a347bb89ab2567120eb9af4cf6648c1809711274

Analysis

max time kernel
1201s
max time network
1218s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/07/2023, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d81c09d8249410587ae.zipan
Size

276B
MD5

b82f1bc5df550816c073a763b4d1d082
SHA1

4ff6933948f369caeca095ce125ac659832b62ef
SHA256

56f7249d7d6a79d03e5c59848501fb46aafe8ea326cb9362dfec6c9e5006ac91
SHA512

60ff6528877bc4d6abec62680ec8ccde72e4e76a160d31708d29bf097bbea4aca0a5e22a8ea2de23486c9f02364a1ac121be649961c10eec448340cc179ed1fe

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\zipan_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\.zipan	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\zipan_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\zipan_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\zipan_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\zipan_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\.zipan\ = "zipan_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\zipan_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2912	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2912	AcroRd32.exe
2912	AcroRd32.exe
2912	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1712	1504	cmd.exe	31
PID 1504 wrote to memory of 1712	1504	cmd.exe	31
PID 1504 wrote to memory of 1712	1504	cmd.exe	31
PID 1712 wrote to memory of 2912	1712	rundll32.exe	32
PID 1712 wrote to memory of 2912	1712	rundll32.exe	32
PID 1712 wrote to memory of 2912	1712	rundll32.exe	32
PID 1712 wrote to memory of 2912	1712	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipan
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipan
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipan"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
92229fac2676419fe87d9068c7c649e7

SHA1
1692a4eaf984b51f933dd79857ebe034ab66986a

SHA256
5bed69db97942a02e308c4ec01cbdd9bc1f3a44b2c9956ebbaa5b025ab7e1b24

SHA512
beb2d5555e9ee940002384ae6b486f9b8ea4f32a2a174bad481b80bc688ed5e869b2afb737b7590f6ce715d6ba977a43d86564b6a3a8987398ca1aeaa79f5955

Download Submit