6ef26a8ac83d7e17b484e7f3de0a66d5d27a32b0b48ed55517c2f6723b67d8da

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01/09/2023, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

baseline.profm
Size

164B
MD5

a3e1eafc281af00b0e609f5f95e41ade
SHA1

2530d01bee9f999b047c8370d50a6bba994b01dc
SHA256

4193582e3057eae684e752eacc73b04c92797c29d8fc26dd36c9435cb5addb40
SHA512

25098c74fbb9b8967841847e4ac5a3b2d863132acb28f494d77b9a7b7295267dff818be13d92b21dc43c68caf72f0579ceb0e2e5254b085c26cf41469c37bec4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\.profm	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\.profm\ = "profm_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\profm_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\profm_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\profm_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\profm_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\profm_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\profm_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2652	AcroRd32.exe
2652	AcroRd32.exe
2652	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2600	2820	cmd.exe	29
PID 2820 wrote to memory of 2600	2820	cmd.exe	29
PID 2820 wrote to memory of 2600	2820	cmd.exe	29
PID 2600 wrote to memory of 2652	2600	rundll32.exe	30
PID 2600 wrote to memory of 2652	2600	rundll32.exe	30
PID 2600 wrote to memory of 2652	2600	rundll32.exe	30
PID 2600 wrote to memory of 2652	2600	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\baseline.profm
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\baseline.profm
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\baseline.profm"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9092bf7e3e05235ee247ab93cac10065

SHA1
e8e150380604ca441ab5d6a3903f20d6d701f762

SHA256
9a96a1534aa90df6bba60a4de70b49bcade3b72f81c113df719b81f2c5170beb

SHA512
f2555b997dc8de7a58fd6256e26e4a94aa622895c5709d5c7642a6aaddbcd4080d1f00022d1bf468cdff49759834739224e02f537aa031d73b574d7c382b173a

Download Submit