cdebaed503fc2ba944c9a736c8145de1aaeb7ca24871efe27ab7e02238361ca1

Analysis

max time kernel
166s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20/09/2023, 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mlgAntivirus/translations/qt_cs.qm
Size

186KB
MD5

9f597d2c5ce11a6ae1321a3121a2c9a4
SHA1

f90316b9b9f780f1b5838d8c5e819021dbe54fe0
SHA256

a78670b49404bda381bb08d8a57882e6ac018e77a360ac79a455ddd5849a02e7
SHA512

cb2039cbfafc8c891eba0a175d1408f95510a6a9571a380cd3663f66d16b80cddc73152f0381c30096f4e60037bcfbba77efb19679de79feca69352a1387b1db
SSDEEP

3072:HwWUH1mguUX0CERaamGjg9E8SSOQfO/JlwVOMxrboRPqWxXfQvO7zjBf:HwXHm4Gj/QfOr8Gd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\qm_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\.qm	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\qm_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\qm_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\.qm\ = "qm_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\qm_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\qm_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\qm_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_Classes\Local Settings	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1996	AcroRd32.exe
1996	AcroRd32.exe
1996	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2944	2316	cmd.exe	29
PID 2316 wrote to memory of 2944	2316	cmd.exe	29
PID 2316 wrote to memory of 2944	2316	cmd.exe	29
PID 2944 wrote to memory of 1996	2944	rundll32.exe	31
PID 2944 wrote to memory of 1996	2944	rundll32.exe	31
PID 2944 wrote to memory of 1996	2944	rundll32.exe	31
PID 2944 wrote to memory of 1996	2944	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mlgAntivirus\translations\qt_cs.qm
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\mlgAntivirus\translations\qt_cs.qm
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\mlgAntivirus\translations\qt_cs.qm"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
afe334d75be861ec76b414d465ec694c

SHA1
141c80907caef007e65775eb1d3ef5ef39d5e74f

SHA256
ffcc959e6b5fa04d3161a727018d807c4d6697b4dc2f178c91e2c0b168750916

SHA512
062fc886e996d4cf739e85dcdfaa65ec258d41627ea51139e233d456420d7d9b032461a5ccfe9ac14add1ec7c6180d896c431ce2cdd1f42342bce933027f99d6

Download Submit