61859a2460b667071ecd47bb30206247afc972d6a02f5932d827057734347133

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25-07-2023 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

newhotmail/hotmail/images/.ds_store
Size

6KB
MD5

194577a7e20bdcc7afbb718f502c134c
SHA1

df2fbeb1400acda0909a32c1cf6bf492f1121e07
SHA256

d65165279105ca6773180500688df4bdc69a2c7b771752f0a46ef120b7fd8ec3
SHA512

58941214a8334331e52114aab851fc3d8d5da5dd14983f933da8735c24b0ddcac134e8f13692553199c4d9a14a4b3188b62878a30b9d696edda1204666b60837
SSDEEP

6:VWAlXN6XkEslX/9ldlXSPnrtHP8//kHLEk0/ulXSPnrtHP8//k:QAXN9EEX/HnXw6XMLEk0/qXw6X

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\ds_store_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.ds_store	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\ds_store_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\ds_store_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\ds_store_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.ds_store\ = "ds_store_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\ds_store_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\ds_store_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2944 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2944 AcroRd32.exe
2944 AcroRd32.exe
2944 AcroRd32.exe

pid	process
2944	AcroRd32.exe

pid	process
2944	AcroRd32.exe
2944	AcroRd32.exe
2944	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2576 wrote to memory of 2936	2576	cmd.exe	rundll32.exe
PID 2576 wrote to memory of 2936	2576	cmd.exe	rundll32.exe
PID 2576 wrote to memory of 2936	2576	cmd.exe	rundll32.exe
PID 2936 wrote to memory of 2944	2936	rundll32.exe	AcroRd32.exe
PID 2936 wrote to memory of 2944	2936	rundll32.exe	AcroRd32.exe
PID 2936 wrote to memory of 2944	2936	rundll32.exe	AcroRd32.exe
PID 2936 wrote to memory of 2944	2936	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\newhotmail\hotmail\images\.ds_store
1⤵
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\newhotmail\hotmail\images\.ds_store
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2936

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\newhotmail\hotmail\images\.ds_store"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2944

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
65141fb3574df7dc5a8be566b5a36113

SHA1
fee3eb7bbde3c5867e1aacc41574a51606ecff90

SHA256
c3231db2629daa74a17ba90b8b00201f6c48cf01488fc0838f676c9d09eec4fb

SHA512
3b02b6a88c7de8125afb9317637945114256d76c5ed1ba016cfce881f26ba2973604aa444e94717beb2a37c42870318626846c89e885ec9ca87e70d5883f9865

Download Submit