3ea350fa6916e36ba67a8a17a347bb89ab2567120eb9af4cf6648c1809711274

Analysis

max time kernel
1203s
max time network
858s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/07/2023, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d81c09d8249410587ae.zipad
Size

276B
MD5

2d36db31fdf2cda80ef2d775218f5882
SHA1

ce7397f4f983fe01730060bb54ab30845b7f8b1b
SHA256

5508df553d9583b638144e4b0bde3309f73e210210e32633f0c9361eb20874ab
SHA512

377b99003b1ef3cc4331168b373f41978c999b25433785059699d6ed8e2e61431912c540b869018f1390735f48e102aba5d5a29ffc44ab4704f6e134ae2907c1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\.zipad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipad_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipad_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\.zipad\ = "zipad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipad_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2984	2108	cmd.exe	29
PID 2108 wrote to memory of 2984	2108	cmd.exe	29
PID 2108 wrote to memory of 2984	2108	cmd.exe	29
PID 2984 wrote to memory of 2720	2984	rundll32.exe	30
PID 2984 wrote to memory of 2720	2984	rundll32.exe	30
PID 2984 wrote to memory of 2720	2984	rundll32.exe	30
PID 2984 wrote to memory of 2720	2984	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipad
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
69a75e834052a6c285227b570e0062af

SHA1
302176c741acb2abeb1c20c756ca63901fdb1b2c

SHA256
f581d51aff7301e2a6962dff5bfa83e4ebff6a7776f52bdfa7da66ecca14c8cd

SHA512
be42920cf7e375b3c0dab35901b8d7d2ed61dee054f55b2e3be55787020e4e40871f0347024dbac609f4f10d8056bd1252c94b8759ba28989d96aa01fb955574

Download Submit