153410238d01773e5c705c6d18955793bd61cb2e82c5c7656e74563bb43b3ffa

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/09/2023, 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

com/google/android/gms/measurement/internal/AppMeasurementDynamiteService$zzb.class
Size

1KB
MD5

f5604278b0d7aeba5aba3c413663623a
SHA1

f1c4fb18990204272b9ac5e75ec5b9a337740192
SHA256

80bb1e79213073bbba15a967ab15659d2e7c7699326937370e6f61b692d04d7a
SHA512

d84b146833bb4527416f9d3ec439bb1c8d3f4a946b9325f58e0126580dfe17b4c336ed5d96db7f0724076b7a19a4267bbfcb253dcc5f8dff4decceca068f5746

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\class_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\.class	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\class_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\class_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1712	2412	cmd.exe	29
PID 2412 wrote to memory of 1712	2412	cmd.exe	29
PID 2412 wrote to memory of 1712	2412	cmd.exe	29
PID 1712 wrote to memory of 2720	1712	rundll32.exe	30
PID 1712 wrote to memory of 2720	1712	rundll32.exe	30
PID 1712 wrote to memory of 2720	1712	rundll32.exe	30
PID 1712 wrote to memory of 2720	1712	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\com\google\android\gms\measurement\internal\AppMeasurementDynamiteService$zzb.class
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\com\google\android\gms\measurement\internal\AppMeasurementDynamiteService$zzb.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\com\google\android\gms\measurement\internal\AppMeasurementDynamiteService$zzb.class"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e95f08ad8318d68bf5a8afd0e87a1749

SHA1
0c9379e712f0f7f02110a7b9ddbcf8a7b5bc8a24

SHA256
2ad7767d3f87ccb72449ad47c9b88b2b2271edaa63c90db60141692c24788b6f

SHA512
cd42b7f5bab9427c41e8542fa61f5f879e0cc91ae501ecd241511751064c8ce5d0bd303c51d22e564eb6231a261ad4317c92f44716dda3f4ea4f60675dcd8c38

Download Submit