3ea350fa6916e36ba67a8a17a347bb89ab2567120eb9af4cf6648c1809711274

Analysis

max time kernel
1201s
max time network
1217s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/07/2023, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d81c09d8249410587ae.zipao
Size

276B
MD5

44b3b9889a49bc656fd3fa416a8a69de
SHA1

e75b91e7f207f94592f81097655ca189385cb6f2
SHA256

abfe274f9dc29c2a3debf0de9ad4d70574a93fb382d9d43c7a08b8a4c4d47810
SHA512

1c09fa5a9755fd26f990a07a57bb13ef4ea54dd3137f74519175b98a469d18b7c838b42f75e12d22c6602ce6780f7eb3f741c0ecf3d7885ea5e5e9d367290455

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\zipao_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\zipao_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\zipao_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\.zipao\ = "zipao_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\zipao_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\zipao_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\zipao_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\.zipao	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2936	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2936	AcroRd32.exe
2936	AcroRd32.exe
2936	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2140	1084	cmd.exe	31
PID 1084 wrote to memory of 2140	1084	cmd.exe	31
PID 1084 wrote to memory of 2140	1084	cmd.exe	31
PID 2140 wrote to memory of 2936	2140	rundll32.exe	32
PID 2140 wrote to memory of 2936	2140	rundll32.exe	32
PID 2140 wrote to memory of 2936	2140	rundll32.exe	32
PID 2140 wrote to memory of 2936	2140	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipao
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipao
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipao"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
529e14ee86e1c636b427527783cae73e

SHA1
eaa416d2886f5aa3b05666ab6cbead18e63901c4

SHA256
1dd7fe1133febce13bcfe7bbeff46a8b55985818c07ed6de43c31d5010591127

SHA512
40da229ac053bd3d220e0ea318a2df2f36e403cc993d4dc9cfc56251f87d5ccf55291b9ddebf39bfe9da03a32833b80027f483947805026243b5f616a1b7a5e1

Download Submit