570262f1083db8e141634c64bebe7f210d0c4d6615d3770fc99bc682572c9a4a

Analysis

max time kernel
90s
max time network
18s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
28/08/2023, 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

es-file-explorer-4-4-0-2-1.apk
Size

39.6MB
MD5

410b367406a93d26687a962ff89d853c
SHA1

5fa6b0e7ba55630313c76f946352edbc92477e84
SHA256

570262f1083db8e141634c64bebe7f210d0c4d6615d3770fc99bc682572c9a4a
SHA512

55c80b6aca17b06ca29232cb713ecfbf22d7ce757bd8a1eee8267cef39d6eb6c4e06630340b47024020a28001e8921b5266fa0329f96514a6d64008434c695a1
SSDEEP

786432:JkF3OGlg0Fwo3/xYRFie+y9Cd8jZQBvkgiRn4Enp6PXFXm:JEQ0nY6e/od1kWlm

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\apk_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\apk_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\apk_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.apk\ = "apk_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\apk_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\apk_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.apk	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\apk_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2052	AcroRd32.exe
2052	AcroRd32.exe
2052	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2912	2076	cmd.exe	1
PID 2076 wrote to memory of 2912	2076	cmd.exe	1
PID 2076 wrote to memory of 2912	2076	cmd.exe	1
PID 2912 wrote to memory of 2052	2912	rundll32.exe	30
PID 2912 wrote to memory of 2052	2912	rundll32.exe	30
PID 2912 wrote to memory of 2052	2912	rundll32.exe	30
PID 2912 wrote to memory of 2052	2912	rundll32.exe	30

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\es-file-explorer-4-4-0-2-1.apk
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\es-file-explorer-4-4-0-2-1.apk"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2052

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\es-file-explorer-4-4-0-2-1.apk
1⤵
- Suspicious use of WriteProcessMemory
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6b193d90a0d028055f1051f5cbc302fa

SHA1
74a96fc84832f9d384519b9edfb1880208aec539

SHA256
a1162eb9efff7ec2c7ea37b920c2538400ce63a26589b45d8637d5626b73009e

SHA512
c41df477d5df784af7de304f273e11a7ee7b4fadbea7c8a9fff5417204becbb2e617ef475f053fb6e40f71a5b55089d6ff2229ede45a5165522f0f54b03a89a9

Download Submit