61859a2460b667071ecd47bb30206247afc972d6a02f5932d827057734347133

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25-07-2023 11:01

Target

newhotmail/hotmail/block_detectors.php
Size

14KB
MD5

51b39bfbec6e42f6cf18cfadbc77fb37
SHA1

b3fdfe6f7ac7a0f92abfc4e90454dc506958f7ff
SHA256

5f8eb3eea1c55b271dbf1140e768d202ebf1dd8f1601a23e4c1071ccb86c52ed
SHA512

eb44ffbcb9bd6d723cf3e90dca566562bb83679e85e8aad7c712955999dc975e81d0fc8b845e3d0a746cc19e5f581843c27f70d490e97917051a893909605a98
SSDEEP

384:f/QT2Q1iRbQjXc51DI7tgYERU2TeZPz8iKOI2wERHdmp3cb41D:f4T2QARbQjXM1DI7tgYERRqvZOcgpd1D

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.php	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.php\ = "php_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\php_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\php_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\php_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\php_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\php_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\php_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2084 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2084 AcroRd32.exe
2084 AcroRd32.exe
2084 AcroRd32.exe

pid	process
2084	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2184 wrote to memory of 2528	2184	cmd.exe	rundll32.exe
PID 2184 wrote to memory of 2528	2184	cmd.exe	rundll32.exe
PID 2184 wrote to memory of 2528	2184	cmd.exe	rundll32.exe
PID 2528 wrote to memory of 2084	2528	rundll32.exe	AcroRd32.exe
PID 2528 wrote to memory of 2084	2528	rundll32.exe	AcroRd32.exe
PID 2528 wrote to memory of 2084	2528	rundll32.exe	AcroRd32.exe
PID 2528 wrote to memory of 2084	2528	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\newhotmail\hotmail\block_detectors.php
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\newhotmail\hotmail\block_detectors.php
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\newhotmail\hotmail\block_detectors.php"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2084

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
66a05d0342a20ff2418e29cbef5d6661

SHA1
f924da25f228f573abe66608db4e93db2ba729b2

SHA256
2ac0b9ec68240aeb10e9c79f76f5b4a184b6c315359ace13054a7c25e26056ae

SHA512
74b2041f6534036605eb0e122bdfd22e352013313b54f463e06f5eed8e0b5a0d5350a9f8ccec56163b55cc15f47159b80bb76a69d9e36bdc409a6c3511e09e60

Download Submit