b7e59768071d2e1fa278737c39770d2c712cc4c7c9a631c42ae06b7acd4f679a

Analysis

max time kernel
172s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BlackSludge_AnimDesc.plist
Size

18KB
MD5

4e6e70dc3009f57a926072d398c2a7e7
SHA1

35c27fd11b8d6a2f20aab3bf91a18a9388464bc0
SHA256

27cb9a034d3ba468d8dc629c9bae1c428454fa4d8063884d1e13b6cf3b09fc0a
SHA512

8524b9211bd954e2da745e71c550775de8b6da47a4bb3b48bc785163611a6035a095dc72018470c67778adf310a1c54491100144d2c74b742d05f899e5cece1e
SSDEEP

96:UyspJtTJO02JOUyZV6uz3xeJZOMEuhYxeMIZOUuPRxeZ3yZV6uz3xeJZOMEuPxxl:Zsxu

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\plist_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\plist_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\plist_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\plist_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\.plist	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\.plist\ = "plist_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\plist_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\plist_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2624	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2624	AcroRd32.exe
2624	AcroRd32.exe
2624	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2628	2268	cmd.exe	28
PID 2268 wrote to memory of 2628	2268	cmd.exe	28
PID 2268 wrote to memory of 2628	2268	cmd.exe	28
PID 2628 wrote to memory of 2624	2628	rundll32.exe	29
PID 2628 wrote to memory of 2624	2628	rundll32.exe	29
PID 2628 wrote to memory of 2624	2628	rundll32.exe	29
PID 2628 wrote to memory of 2624	2628	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\BlackSludge_AnimDesc.plist
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\BlackSludge_AnimDesc.plist
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BlackSludge_AnimDesc.plist"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
357e4861df4c9323006e371ea48a0f83

SHA1
02aa6e1076191878d9a795340025f5fc01a16292

SHA256
c4cba20f39c8fd98fc742b5bca55634daab54ff1abbe831122e5ced4d4b53b0c

SHA512
faee17b151d7dfb43d2656202f0199e76580ae1e3fd406f9825ba4596d8854762791fe3101b7b00467f6a096736be1b2dd1fa695a874f243a0f374e238807539

Download Submit