eece0e8b1562092df3beedb1dcfe8be36688d274ae59cf491dc9a42276ea3d62

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HwProfiles/Gigabyte GA-E350N [Rev.3.0].hwp
Size

281B
MD5

55e5d7c7d60d40d8b64dbf744b8070be
SHA1

a9521bfb3032eba7831ee418eae83f8328e9e8b4
SHA256

5ee0462da7d38e3d07cf942dc042332304738d474d7e69aefff9f149a590871c
SHA512

3d1ec0fba5a7cd1210f0e70c2a4ef74134a491c8d4c4f4a58f721f212933b575985039ac1de7b97de5929b092c625039469babc11ba38fe9bfef313cc7fd1b23

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\hwp_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\hwp_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\hwp_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\.hwp	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\.hwp\ = "hwp_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\hwp_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\hwp_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\hwp_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2856	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2856	AcroRd32.exe
2856	AcroRd32.exe
2856	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2448	2532	cmd.exe	29
PID 2532 wrote to memory of 2448	2532	cmd.exe	29
PID 2532 wrote to memory of 2448	2532	cmd.exe	29
PID 2448 wrote to memory of 2856	2448	rundll32.exe	30
PID 2448 wrote to memory of 2856	2448	rundll32.exe	30
PID 2448 wrote to memory of 2856	2448	rundll32.exe	30
PID 2448 wrote to memory of 2856	2448	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\HwProfiles\Gigabyte GA-E350N [Rev.3.0].hwp"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\HwProfiles\Gigabyte GA-E350N [Rev.3.0].hwp
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\HwProfiles\Gigabyte GA-E350N [Rev.3.0].hwp"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
58baea1d803218b138a76fa7114a506b

SHA1
72d513b68738e9a7449b690908c02fe9f35ac18c

SHA256
dc8002e427b78847641fe463549528045daad1e2801c6c9684748e841744f969

SHA512
09c625bd3a1f4742ea7d33d2087aa43febd738402a624d4f05419de9400fd3add4d683479c112c23d82d1342cbd4234a6e63fa17a277863b1a59eb31a31e3a8c

Download Submit