66a32b79ff2c15ac32dd147b9509c1d0b8fb0e24f91f478352fb9564d45416f8

Resubmissions

06-08-2023 19:58

230806-yps8psde2y 7

Analysis

max time kernel
152s
max time network
136s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06-08-2023 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01_TriggerAndDisplayCampaign.md
Size

751B
MD5

5846bacf61ff1d363a1c0aac77975af3
SHA1

71ca62fa33c5dc640a8c9ca6c4c0f695a95eefa1
SHA256

b5a484f68e00d49f58606178fafe042c3696de9152c4d7dc647dbf41a8d1090a
SHA512

313da249605b63c04f163f761904b156896b32a6cce293c32196fb9d098028849c289fec504ebd6769e283ceaacac46a19f596f72c55eb8306c20941ed6fe1d6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.md	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\md_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2920	2260	cmd.exe	29
PID 2260 wrote to memory of 2920	2260	cmd.exe	29
PID 2260 wrote to memory of 2920	2260	cmd.exe	29
PID 2920 wrote to memory of 2720	2920	rundll32.exe	30
PID 2920 wrote to memory of 2720	2920	rundll32.exe	30
PID 2920 wrote to memory of 2720	2920	rundll32.exe	30
PID 2920 wrote to memory of 2720	2920	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\01_TriggerAndDisplayCampaign.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\01_TriggerAndDisplayCampaign.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\01_TriggerAndDisplayCampaign.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
971482efbac57758aa927cd476875255

SHA1
3a2f287f2ae55a2ed26eb259e5058f791362ab98

SHA256
bef0eda75ccc756b0ce80c86e885b2d6aa67a69c7f50d5481cddb6185f3be5fc

SHA512
afca4c13416d5b3083d1de597b939db9b4fe08818c7a458ac0458a85b7dffb44c79074536a1ad55482dcf98bc06575a4d32e37becc00d706043ef4f9fa6b548d

Download Submit