4afb71642dd5337dfd6a2c149b27668047856d02e75e1d33fb0a9e308fc5caff

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

baseline.profm
Size

256B
MD5

73b41355821a18a35d8ba826ef1e527d
SHA1

72abada464a5ad7411e77f7b46445de9d62aec30
SHA256

63fb868701c13cc91e3a11610206eb207c40d649ee7ec2cb0d9d8ef418bd49c9
SHA512

2b6f8d8cd24552973ffc721f17e4d5b5da3dcb047719481cd6b1694e640d06f707e3675cbf71757dbb3ee61c01af8f452623b6d98d3c73b6c5033202143fb976

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-274829-3448035668-3231875956-1000_CLASSES\profm_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-274829-3448035668-3231875956-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-274829-3448035668-3231875956-1000_CLASSES\profm_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-274829-3448035668-3231875956-1000_CLASSES\profm_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-274829-3448035668-3231875956-1000_CLASSES\.profm	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-274829-3448035668-3231875956-1000_CLASSES\profm_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-274829-3448035668-3231875956-1000_CLASSES\.profm\ = "profm_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-274829-3448035668-3231875956-1000_CLASSES\profm_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-274829-3448035668-3231875956-1000_CLASSES\profm_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2928	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2928	AcroRd32.exe
2928	AcroRd32.exe
2928	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2788	2216	cmd.exe	29
PID 2216 wrote to memory of 2788	2216	cmd.exe	29
PID 2216 wrote to memory of 2788	2216	cmd.exe	29
PID 2788 wrote to memory of 2928	2788	rundll32.exe	30
PID 2788 wrote to memory of 2928	2788	rundll32.exe	30
PID 2788 wrote to memory of 2928	2788	rundll32.exe	30
PID 2788 wrote to memory of 2928	2788	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\baseline.profm
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\baseline.profm
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\baseline.profm"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
98f2db9d560cb34df95e62ed06c71078

SHA1
6862301e009871a3a769f662050d0c71ddd98e54

SHA256
a006ecf4dd475b07ef965a0dbd4f52f1d0f636bdb032d8aa7838b9e1c173828b

SHA512
cc1eb0866a5b5250c56466f63c99269f4c73ed964bd25f03540881a40812353a0eaded5208ca00cf0ac3eea2abcb881eb67328402ac7bf40c51053041b84d726

Download Submit