61859a2460b667071ecd47bb30206247afc972d6a02f5932d827057734347133

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25-07-2023 11:01

Target

newhotmail/hotmail/css/.ds_store
Size

6KB
MD5

194577a7e20bdcc7afbb718f502c134c
SHA1

df2fbeb1400acda0909a32c1cf6bf492f1121e07
SHA256

d65165279105ca6773180500688df4bdc69a2c7b771752f0a46ef120b7fd8ec3
SHA512

58941214a8334331e52114aab851fc3d8d5da5dd14983f933da8735c24b0ddcac134e8f13692553199c4d9a14a4b3188b62878a30b9d696edda1204666b60837
SSDEEP

6:VWAlXN6XkEslX/9ldlXSPnrtHP8//kHLEk0/ulXSPnrtHP8//k:QAXN9EEX/HnXw6XMLEk0/qXw6X

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.ds_store\ = "ds_store_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\ds_store_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\ds_store_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\ds_store_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.ds_store	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\ds_store_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\ds_store_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\ds_store_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2112 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2112 AcroRd32.exe
2112 AcroRd32.exe
2112 AcroRd32.exe

pid	process
2112	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1220 wrote to memory of 1528	1220	cmd.exe	rundll32.exe
PID 1220 wrote to memory of 1528	1220	cmd.exe	rundll32.exe
PID 1220 wrote to memory of 1528	1220	cmd.exe	rundll32.exe
PID 1528 wrote to memory of 2112	1528	rundll32.exe	AcroRd32.exe
PID 1528 wrote to memory of 2112	1528	rundll32.exe	AcroRd32.exe
PID 1528 wrote to memory of 2112	1528	rundll32.exe	AcroRd32.exe
PID 1528 wrote to memory of 2112	1528	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\newhotmail\hotmail\css\.ds_store
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\newhotmail\hotmail\css\.ds_store
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\newhotmail\hotmail\css\.ds_store"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2112

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0f14c1d0d5323ca91c0333e9207a91a0

SHA1
412efeb6092dca1e636e2f740269c824776a556b

SHA256
346b0c62da4c0594ac04f834bbc4876a70818147f210aebf323f5c9c575bcee4

SHA512
b4148ed16ddc1ea5a8c5fd6dc7153456cdd830d6d3cdf678f0ab3a5fdccbc4b9763e0eb6ee142dc19e4431a119397d67d1af726130c989b759f381d4f641d9e0

Download Submit