c3d118812e55bc5a51eeb6c4c254abc744b3b7e58450212a153bbc2c8af196c8

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23/10/2023, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KeyViewer.exe.config
Size

190B
MD5

db70283e9a0cd695ca637e2c71c0795c
SHA1

2cd1c40815eec56780fb5174c6da3e6da2ea7fb3
SHA256

12e32f8267da6d13095b639e4338fa461346a781ad461aa0e449c0e11eb52b80
SHA512

04775a7f291b6f72826fb0e8e3e271ecac9ce81e4419d5f3aca820982a90a91ebdfe7cfac9f577b77453bf04871a060b4d7638d3c580bddb3fa4b8a360cc2da1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2568	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2568	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2568	AcroRd32.exe
2568	AcroRd32.exe
2568	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2568	2508	cmd.exe	29
PID 2508 wrote to memory of 2568	2508	cmd.exe	29
PID 2508 wrote to memory of 2568	2508	cmd.exe	29
PID 2508 wrote to memory of 2568	2508	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\KeyViewer.exe.config
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\KeyViewer.exe.config"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
050469e23886133d61e28c7e82d8dcc7

SHA1
a9e4c05f9387766141ca3bbdb5bc3f0dbc853888

SHA256
2a0452ae908141baec3d0540cd7e0aaf7c986a68d6015b941c6425aca4f3fdec

SHA512
bd0a30987d02f3f49a7a34672a1666772fccc03d9410b7cb529cdad9e77a2e38f354aa4578b7eb19b0ce62de0b7ccc304dc611f6226f9f30432fb5867f2d74a2

Download Submit