6ef26a8ac83d7e17b484e7f3de0a66d5d27a32b0b48ed55517c2f6723b67d8da

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01/09/2023, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

filedownloader.properties
Size

3KB
MD5

f763ad237cc9788bfafbff3a51ead551
SHA1

a8a011a79ae302dd05d6b07e1402035475ec3294
SHA256

c5c00932f73f4d8f47177c35ce2c122593f8de0a9f3cfc432cd76fc18881c7f0
SHA512

36eb23973c896959e7713ef6c83661ac581406b4d1486a8a04f3b7391a0ecc9b1101324e25ef1f7a9248f10a7906be28261c3d459365fc2755d7fcb2e1182a8d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\properties_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\properties_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\properties_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\properties_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\properties_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\.properties	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\.properties\ = "properties_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\properties_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2736	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2736	AcroRd32.exe
2736	AcroRd32.exe
2736	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2620	2792	cmd.exe	29
PID 2792 wrote to memory of 2620	2792	cmd.exe	29
PID 2792 wrote to memory of 2620	2792	cmd.exe	29
PID 2620 wrote to memory of 2736	2620	rundll32.exe	30
PID 2620 wrote to memory of 2736	2620	rundll32.exe	30
PID 2620 wrote to memory of 2736	2620	rundll32.exe	30
PID 2620 wrote to memory of 2736	2620	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\filedownloader.properties
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\filedownloader.properties
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\filedownloader.properties"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
48637ec9610ea96b6190cd8a09f54f8e

SHA1
df8c2ee7c8f6118e34f35206405a97872f4723d7

SHA256
2e60401007dba525ebfcbbd1758397daa04d559e9454a94d0e455098cc9c6819

SHA512
35643945c5aef00ecdbb0006341d109a551ab7783b7639cb7d9082315e1e230a226a6f916aab9708e3f91cae2d81516f5dd4bbfba173a2111e15c697d0f3c677

Download Submit