eb655d2bc20b005c8da534c4251532363b70d7162840150f8e94b155d9b26f6f

Analysis

max time kernel
1800s
max time network
1571s
platform
windows7_x64
resource
win7-20230831-it
resource tags

arch:x64arch:x86image:win7-20230831-itlocale:it-itos:windows7-x64systemwindows
submitted
02-10-2023 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wdahsv.au3
Size

900KB
MD5

021b31ea75476effc7e8feba0be18d6f
SHA1

ecbab3411a272e690951d80cf368a69fe5a72d0d
SHA256

7bf22707254e18cbad1a8ab1683158839563f6b85cda1adc2f4a7f3e83e7cb22
SHA512

12d323bd926845696de83a7a63e182eb3002e7d4035c476efad30261f35c88752b00d497801e0d87a3a6d99e772c844180b524e7d0d026e2493422db9b78be2e
SSDEEP

12288:fFoJt042Tc0rv2Yvv6/1fePD63XCWngA+QSX92blPkc:fF40423RK/1fYD63XYA+19mZ1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\au3_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\au3_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\.au3	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\.au3\ = "au3_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\au3_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\au3_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\au3_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\au3_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2552	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2552	AcroRd32.exe
2552	AcroRd32.exe
2552	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2724	2876	cmd.exe	29
PID 2876 wrote to memory of 2724	2876	cmd.exe	29
PID 2876 wrote to memory of 2724	2876	cmd.exe	29
PID 2724 wrote to memory of 2552	2724	rundll32.exe	30
PID 2724 wrote to memory of 2552	2724	rundll32.exe	30
PID 2724 wrote to memory of 2552	2724	rundll32.exe	30
PID 2724 wrote to memory of 2552	2724	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\wdahsv.au3
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\wdahsv.au3
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\wdahsv.au3"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
61d7f0450cf60e22d1f3367bbd4541e0

SHA1
5dea4a0c1e123a55ac72686ca355263cfb9e2386

SHA256
fc9433b9b2b4805a88d6f85a16fb2dc327a4e26bc0804f12e2c83ed8ee8cbabf

SHA512
c15b8a319ff1a8caa46323478d2635cf3cae1a721d20ff55b4713eb5ad6014784ae06603fd4bf78bfe4b35d3aac311ab928a4e94bca0e27796e1e855795fb7d1

Download Submit