6c90dfc63bce24689c0c5922f8eac1779c01156dc54c3066bae8ca65198949f5

Analysis

max time kernel
240s
max time network
151s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26-08-2023 22:06

Target

com/google/android/gms/dynamite/descriptors/com/google/android/gms/measurement/dynamite/ModuleDescriptor.class
Size

589B
MD5

d44f1336257a0e9e8ccd1eef110a574a
SHA1

f357328756b0ed4d91bcad95985d32eeaed88ace
SHA256

22a05e1d100af989d58cebefa51b3c74bb0979bea69b04082b02a4c1d9d49e2d
SHA512

e787f7b627305cdca6fa5ef28144e575b1fa057f24786dd7426d21e55f76f48f83a4be2004a12999c72725966121e1e46fea3c13ad4a25fcbcbf6d4b88f4d3d0

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\class_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\class_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.class	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\class_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2148 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2148 AcroRd32.exe
2148 AcroRd32.exe
2148 AcroRd32.exe

pid	process
2148	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2392 wrote to memory of 2756	2392	cmd.exe	rundll32.exe
PID 2392 wrote to memory of 2756	2392	cmd.exe	rundll32.exe
PID 2392 wrote to memory of 2756	2392	cmd.exe	rundll32.exe
PID 2756 wrote to memory of 2148	2756	rundll32.exe	AcroRd32.exe
PID 2756 wrote to memory of 2148	2756	rundll32.exe	AcroRd32.exe
PID 2756 wrote to memory of 2148	2756	rundll32.exe	AcroRd32.exe
PID 2756 wrote to memory of 2148	2756	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\com\google\android\gms\dynamite\descriptors\com\google\android\gms\measurement\dynamite\ModuleDescriptor.class
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\com\google\android\gms\dynamite\descriptors\com\google\android\gms\measurement\dynamite\ModuleDescriptor.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\com\google\android\gms\dynamite\descriptors\com\google\android\gms\measurement\dynamite\ModuleDescriptor.class"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2148

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
917a433be69ef48c8454bc2831293525

SHA1
f6c2cef10a5a748e82bc40efb37a1a053e3ed6b0

SHA256
b400d3bb453b90788c6824328cda0863c1e6f3b2237e720f6deca01295d35e3b

SHA512
f93a5f59c05c7e94679dfb49a807b179b14025ca509edc9af736cb33d6f99f9bdded06d153870e6635ebcbc36e1fa94eb58a3fbb0f7ae0810a36de5f33a15c4d

Download Submit