4eb8b872189e7c750f1a6284f566fb7264d75139ac5a6ad063228853e359cdd9

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24-07-2023 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dgYoooUm.au3
Size

751KB
MD5

851bdfe9ea52b59d50b8d2de086921c9
SHA1

5a1585479349ab9a64134ce4a3063b513aabb9ce
SHA256

09bf1b88716c49a62cb4ff708f7ff4f09cb7c3ff42e58661802cd66f1a2a0311
SHA512

9e4f76d45d9eefea10a207b53b771887064012423133d6ba04a0591abf1ac15a4b100a23df74d7a51edb86ec766ec2de4b416c7a13986fb9a8511efe1ea1162b
SSDEEP

12288:S7k7ag2ZA0BSemCiZUYeaFCjWuweGqJ/4QDHrii6OoM:SeD2SHeWuwItWiloM

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\au3_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\.au3	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\au3_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\au3_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\au3_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\.au3\ = "au3_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\au3_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\au3_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2548	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2548	AcroRd32.exe
2548	AcroRd32.exe
2548	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 1672	2636	cmd.exe	29
PID 2636 wrote to memory of 1672	2636	cmd.exe	29
PID 2636 wrote to memory of 1672	2636	cmd.exe	29
PID 1672 wrote to memory of 2548	1672	rundll32.exe	30
PID 1672 wrote to memory of 2548	1672	rundll32.exe	30
PID 1672 wrote to memory of 2548	1672	rundll32.exe	30
PID 1672 wrote to memory of 2548	1672	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dgYoooUm.au3
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\dgYoooUm.au3
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dgYoooUm.au3"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6027015483c511a21569a3805d09f9f4

SHA1
ecbd3da7eff01d59264070cbeb699042d779e08a

SHA256
f906e63e02602599838f8a363609f66db2c2516e6baf3bb21f3a35cafd150165

SHA512
c531f10b5e8cdb00e3289b53b78d981398951ef7cbe51f8b81bd9aca26caaebebb987ec8cf04ab8256c90f3533ac532e8cde89fca3f478a351fec9a344d599c4

Download Submit