843d5892ae16569f2b69899a9b344c4d8a36d441591006c9075c497a3bf7af20

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29-08-2023 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp/lattedock-mvHtAR/reversed.colors
Size

3KB
MD5

6bd45ac2164098df0998dc719ea9a656
SHA1

44698fa61bfa1a670312f1d278899ba3aaed75bc
SHA256

e7ac2d73cbbd251990b2b9b1710843219574c993e7945365c6acb1e0c393dcdb
SHA512

5e4fcd916a7d369f50487754fa1e11a0f17f323f6178ada736512628c886ad52f846b6f0f8cb42735754087f448e97ad77d818483a5f54acff367c7974a55637

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.colors\ = "colors_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\colors_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\colors_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\colors_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\colors_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.colors	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\colors_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\colors_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2608	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2608	AcroRd32.exe
2608	AcroRd32.exe
2608	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2224	1700	cmd.exe	29
PID 1700 wrote to memory of 2224	1700	cmd.exe	29
PID 1700 wrote to memory of 2224	1700	cmd.exe	29
PID 2224 wrote to memory of 2608	2224	rundll32.exe	30
PID 2224 wrote to memory of 2608	2224	rundll32.exe	30
PID 2224 wrote to memory of 2608	2224	rundll32.exe	30
PID 2224 wrote to memory of 2608	2224	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tmp\lattedock-mvHtAR\reversed.colors
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tmp\lattedock-mvHtAR\reversed.colors
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tmp\lattedock-mvHtAR\reversed.colors"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dd563a1b3a3d8f0d7563d02ffc91314a

SHA1
4460a97b49a4e92400ad78f83624a37e6a48f957

SHA256
4c0380957df1a6b31895141697957899adeea876e30e537e8d551c5c3622fea3

SHA512
b66e3211d4178094f90a31603de6294006f29bb7898543364a1d8c820e1987c1966f6a3cdd1c264942a086c8f3385eb419b3d933c98c105f3dfe89d092d78354

Download Submit