48e035381b0324d30b35f5b6289b98794389c9363de3d974252b18d958a5b767

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29-08-2023 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data.win
Size

53.5MB
MD5

eabc4f7d415692a933ea0691ffd08d08
SHA1

5dabb41a12330cf424eac9dd81cf3d3027678f71
SHA256

48e035381b0324d30b35f5b6289b98794389c9363de3d974252b18d958a5b767
SHA512

a91f76a5a521056ad10cf5a041de1e84ea100f81c9b2997a1cd656b597a803060b7a67186462f853a0098f9e59b9be834048950f0134a4b0bf18adf20db8233c
SSDEEP

1572864:lH5+/hZejfE8KDWYk5YGIeyZ1fxFITJ1h6E1:5io5YGkV7y7Z

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.win\ = "win_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\win_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\win_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\win_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\win_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.win	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\win_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\win_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

2468 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

3024 AcroRd32.exe
3024 AcroRd32.exe

pid	process
2468	rundll32.exe

pid	process
3024	AcroRd32.exe
3024	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 3012 wrote to memory of 2468	3012	cmd.exe	rundll32.exe
PID 3012 wrote to memory of 2468	3012	cmd.exe	rundll32.exe
PID 3012 wrote to memory of 2468	3012	cmd.exe	rundll32.exe
PID 2468 wrote to memory of 3024	2468	rundll32.exe	AcroRd32.exe
PID 2468 wrote to memory of 3024	2468	rundll32.exe	AcroRd32.exe
PID 2468 wrote to memory of 3024	2468	rundll32.exe	AcroRd32.exe
PID 2468 wrote to memory of 3024	2468	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data.win
1⤵
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\data.win
2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2468

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\data.win"
3⤵
- Suspicious use of SetWindowsHookEx
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1b3b52dd161bc6a0df8273b9bc0e84a6

SHA1
a6d626bb47d6382d7e291603ffd3741f00abb646

SHA256
a475b5d2323920eaf2c223940e62e7e29181cacbc2659947175da2482c11b241

SHA512
2e85aba30da2a891381b587cab3332c49512a4eb703f1d8c5256a6ed1e1fc3d43add7e7d0c17112759378b46624b67b6dfc7bcd71756f3c815d8d8642e28f9ad

Download Submit