565e3abc2f08e6231bb981c366fccfe42796b6ff530bdc66d1aaa5f7e23b05f0

Analysis

max time kernel
152s
max time network
129s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
06/11/2023, 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Expensive-2.0/natives/OpenAL.dll.sha1
Size

42B
MD5

b1b872f6e2250ca8e24beb0cfafa62bc
SHA1

3276b57a51fbaffa9d89980d3bc6d2b613dd7e2b
SHA256

0eaaa7f11d0892ee4dbb522e654fe5f056a83a886fde7241ad50765dc1822108
SHA512

13e305126806cb2de925e1024a9b54a4e215641c39be8219128d3d5218056a09787343ca64416fa213f7709008206bd98b76ae2b9512467b10b39998499fed2e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\sha1_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\.sha1	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\sha1_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\sha1_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\sha1_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\.sha1\ = "sha1_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\sha1_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\sha1_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2680	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2644	2600	cmd.exe	29
PID 2600 wrote to memory of 2644	2600	cmd.exe	29
PID 2600 wrote to memory of 2644	2600	cmd.exe	29
PID 2644 wrote to memory of 2680	2644	rundll32.exe	30
PID 2644 wrote to memory of 2680	2644	rundll32.exe	30
PID 2644 wrote to memory of 2680	2644	rundll32.exe	30
PID 2644 wrote to memory of 2680	2644	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Expensive-2.0\natives\OpenAL.dll.sha1
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Expensive-2.0\natives\OpenAL.dll.sha1
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Expensive-2.0\natives\OpenAL.dll.sha1"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
26ddc0f0742aa239f8472ad0e8675426

SHA1
a0a180155b4f7c8cf8da6bf89f2120c57f53b681

SHA256
2d7bbabda13f44fcaec5c24bde8db503333e72141d77f568653e5e89374ef860

SHA512
99c513ef019e629eb6e1d9168608c69db7f169621587aa4477a016f9827195e3d61c8e5e0212c2f2fb0a43cdbe9a83b0c5be5929c735f331d6f121b3e72959be

Download Submit