6c90dfc63bce24689c0c5922f8eac1779c01156dc54c3066bae8ca65198949f5

Analysis

max time kernel
210s
max time network
145s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26-08-2023 22:06

Target

com/google/android/gms/measurement/internal/zzk.class
Size

1KB
MD5

d18c0624897134d4ae642aea5931fff6
SHA1

56be326f444f67e72ade968322731d278d3dbdba
SHA256

43757a315704885a384a17e368d5fbca7a7d1d37a7cdbff07e0e3b4df0829f00
SHA512

4d3650c7acb04962e26aeb5e6ffb4576aedba4e1e60555ed58edaba58db45a2f26d64e5c1225a5c45f8b5b51692409d0da7cc8926b5707d8a44e912b2c261646

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.class	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\class_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\class_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\class_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2708 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2708 AcroRd32.exe
2708 AcroRd32.exe
2708 AcroRd32.exe

pid	process
2708	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2824 wrote to memory of 2716	2824	cmd.exe	rundll32.exe
PID 2824 wrote to memory of 2716	2824	cmd.exe	rundll32.exe
PID 2824 wrote to memory of 2716	2824	cmd.exe	rundll32.exe
PID 2716 wrote to memory of 2708	2716	rundll32.exe	AcroRd32.exe
PID 2716 wrote to memory of 2708	2716	rundll32.exe	AcroRd32.exe
PID 2716 wrote to memory of 2708	2716	rundll32.exe	AcroRd32.exe
PID 2716 wrote to memory of 2708	2716	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\com\google\android\gms\measurement\internal\zzk.class
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\com\google\android\gms\measurement\internal\zzk.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\com\google\android\gms\measurement\internal\zzk.class"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2708

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e98a82fa743fd530eb984023638fd341

SHA1
58d45709221578e5b8e1ae446384bf50f848d560

SHA256
81944c8bd743cbb3fb9fc20b5d02b33285fe28a143ef28893971753e2b1a1698

SHA512
b53c2f25081e5c6a1787d3bdc29d7b9699e5b6f17ee495322be847281b491b86206f137b987f286bcc9f9381dede439a30fc626a6ec5715c89dc7f10ef4bcce2

Download Submit