843d5892ae16569f2b69899a9b344c4d8a36d441591006c9075c497a3bf7af20

Analysis

max time kernel
152s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29-08-2023 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp/latte-dock.mrkd.lock
Size

96B
MD5

fc32323fc656df4c929f711088496048
SHA1

c08d09b850b7104446409728c8de49785dcc6260
SHA256

55f6ed7df98e524bb70beff4cf8943128aa8678ff8432029e41b54e61045307c
SHA512

1c3f0538fc15844c476e6543217156295aef5479170f2266b48a8b9971248f313e691bc8480935829ae961e1b58455daacffd246c7509feed0454c6daaa715bd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\lock_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.lock\ = "lock_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\lock_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\lock_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\lock_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\lock_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\lock_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.lock	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2948	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2948	AcroRd32.exe
2948	AcroRd32.exe
2948	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2388	3000	cmd.exe	29
PID 3000 wrote to memory of 2388	3000	cmd.exe	29
PID 3000 wrote to memory of 2388	3000	cmd.exe	29
PID 2388 wrote to memory of 2948	2388	rundll32.exe	30
PID 2388 wrote to memory of 2948	2388	rundll32.exe	30
PID 2388 wrote to memory of 2948	2388	rundll32.exe	30
PID 2388 wrote to memory of 2948	2388	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tmp\latte-dock.mrkd.lock
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tmp\latte-dock.mrkd.lock
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tmp\latte-dock.mrkd.lock"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
21e8583a5362d6b6d43fd0e9a11a2efa

SHA1
65f8dbe8f55d32314108bf30d8acfc4bbe775208

SHA256
a92544a998eac9fa9aee7da266052e5947a55edb93c42bf11bf68ce322e64700

SHA512
3fbcdb5037484456870c1dddbf989a15fe76b923325db57c05486267d152a434bcf7fe7384411c361f912d0ce7a202dada30178a64c0fa7410d9066d10b56bf8

Download Submit