565e3abc2f08e6231bb981c366fccfe42796b6ff530bdc66d1aaa5f7e23b05f0

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Expensive-2.0/natives/glfw.dll.sha1
Size

42B
MD5

f6d4f19a41f245991382bbec2b787919
SHA1

3a77059db5c1f40e3d201919e1a4d2720fbc00f1
SHA256

7dc57d4c1876df5d36f0185c6653ec320c8243b9f660873c611942bd838ae180
SHA512

0f413f38d6efd65fb1c1dc450a06fa7721d5c43b68fc001ef31b1941f931e25ffe224af0fc314262cf9715a1632956e7212a74a52f71261ea214bb97775a1a07

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\sha1_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\.sha1	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\sha1_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\sha1_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\sha1_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\.sha1\ = "sha1_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\sha1_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\sha1_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2896	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2896	AcroRd32.exe
2896	AcroRd32.exe
2896	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2708	2244	cmd.exe	29
PID 2244 wrote to memory of 2708	2244	cmd.exe	29
PID 2244 wrote to memory of 2708	2244	cmd.exe	29
PID 2708 wrote to memory of 2896	2708	rundll32.exe	30
PID 2708 wrote to memory of 2896	2708	rundll32.exe	30
PID 2708 wrote to memory of 2896	2708	rundll32.exe	30
PID 2708 wrote to memory of 2896	2708	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Expensive-2.0\natives\glfw.dll.sha1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Expensive-2.0\natives\glfw.dll.sha1
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Expensive-2.0\natives\glfw.dll.sha1"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e902407c2b625d13f26d99bac4c89d70

SHA1
da86aa1a0b72d0fee47073d8d465fb52aed3ee0e

SHA256
7c7d85071353182b1a4989af9467d3da0a2a2aa4ffdc86899ae0f4638ac576da

SHA512
463b9b2f9c032780361083b9f819bcf71e819d4dcd9bd4de7fe3d89b79cdf87ec43a131bc97c0a582b2319c3e7c38bf75123835acfc12d823fce70ee5378477a

Download Submit