66a32b79ff2c15ac32dd147b9509c1d0b8fb0e24f91f478352fb9564d45416f8

Resubmissions

06-08-2023 19:58

230806-yps8psde2y 7

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06-08-2023 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01_FormAppearance.md
Size

322B
MD5

3bba7461813e3da2938ff6184f335c29
SHA1

299863208fab222d9ce349949e3419e1e47ecac6
SHA256

9c05e519808c8ff45e58ea422f445c718834e6f002751987d5c1c38c4874db26
SHA512

69bd00ba18a0be8a1057b992da3cbea5701024f3797b0313cc95914176668b6abbe7532c7e7c90cdeb744e7f75dcb22ac7246b6a168e5e997d019c85bda48600

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\md_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\md_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2344	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2344	AcroRd32.exe
2344	AcroRd32.exe
2344	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2020	2032	cmd.exe	29
PID 2032 wrote to memory of 2020	2032	cmd.exe	29
PID 2032 wrote to memory of 2020	2032	cmd.exe	29
PID 2020 wrote to memory of 2344	2020	rundll32.exe	30
PID 2020 wrote to memory of 2344	2020	rundll32.exe	30
PID 2020 wrote to memory of 2344	2020	rundll32.exe	30
PID 2020 wrote to memory of 2344	2020	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\01_FormAppearance.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\01_FormAppearance.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\01_FormAppearance.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
81872e3d6bf0f89d1fbda123f0061eb3

SHA1
e7d638ac41b69345a31d498e9836c13bdd252f7a

SHA256
271b77cb13bd9dc7031ab0674ea3ed8554b423b458dcb3a21990a4c30e268523

SHA512
6d2c4a4c54b111fa31ee20a95d9e80f5c9557453cc9fed1fe5a22abb83062556a5b853e57d426e6501bc29a3ee079794eec179ba39b8d736c6840994494168a5

Download Submit