d2379b6baab95a3cf0be78b228374082ca9ee5b76510c7b333c95af38db24e7e

Analysis

max time kernel
153s
max time network
72s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sharedassets197.resource
Size

1.3MB
MD5

e149a23d28c585ecff8f55093be7d950
SHA1

e9f12f53cc6a05fcb4e98808572738560abb0ec6
SHA256

6c118592ca5bbaf3e8eb7e196e4ab663098062abc2e5452e65205aed2190aca5
SHA512

1d6f3b8429ca4924b6e5195dbc2b16afd7c8f02e562981b3b4dc388809230121a2a33834fb983e4be976b75290a11e6c995ab7d44e0fdd414cda6b8a44a5b565
SSDEEP

24576:P9TGlV4Nb89vO2SoNwqQNMvnHghTG8LpkimWzbL77WGRgJPJ:P9Tc281dwqQqHgFBpzfSPPJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\resource_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.resource	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\resource_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\resource_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\resource_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.resource\ = "resource_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\resource_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\resource_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2356	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2356	AcroRd32.exe
2356	AcroRd32.exe
2356	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2532	2644	cmd.exe	31
PID 2644 wrote to memory of 2532	2644	cmd.exe	31
PID 2644 wrote to memory of 2532	2644	cmd.exe	31
PID 2532 wrote to memory of 2356	2532	rundll32.exe	32
PID 2532 wrote to memory of 2356	2532	rundll32.exe	32
PID 2532 wrote to memory of 2356	2532	rundll32.exe	32
PID 2532 wrote to memory of 2356	2532	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sharedassets197.resource
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\sharedassets197.resource
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\sharedassets197.resource"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c8c61a652175b3f962f3e0624705a614

SHA1
ee4dac574533c7858d9e960dc04dbb27231f45e4

SHA256
0b86c1ea9b982e2f82f00bf75859bfbf77fc5d0724efa547a525f5a039d609b4

SHA512
227fb043a21bb159258873e14a5517245dc77ca070488b866ea85ba34da54dc1e50999c04b69c5c965378e4d42bed4a2a6870db23db395d14db2bb073a8e48e3

Download Submit