a971785f310f7a2c8907b8094a585b2d66df20087b9d3b9ef9c2ed02b8e04f77

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Meteos_Test_version_negative_10000.7z
Size

19.6MB
MD5

0297e2072afb71157afe0e6c7648fff2
SHA1

9d65a524ef08982f04dd11eebe4dece4c63559ec
SHA256

a971785f310f7a2c8907b8094a585b2d66df20087b9d3b9ef9c2ed02b8e04f77
SHA512

8d1465426d6a3795416e15f0450c29848be6e4252ec507a8ea44b3cd5936291cf46762f727fadca45e8db0118be92ec6376f330d8430efa46a65bfb3d2f2027d
SSDEEP

393216:ZzhNZ3eTCLNMAhBvhu/jqCs9vovIj++4aRdqDXCp0Q:xZ3eT8NMghu/jq9voD+FRcDWJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\7z_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.7z	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.7z\ = "7z_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\7z_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\7z_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\7z_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\7z_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\7z_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2612	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2612	AcroRd32.exe
2612	AcroRd32.exe
2612	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2648	2576	cmd.exe	29
PID 2576 wrote to memory of 2648	2576	cmd.exe	29
PID 2576 wrote to memory of 2648	2576	cmd.exe	29
PID 2648 wrote to memory of 2612	2648	rundll32.exe	30
PID 2648 wrote to memory of 2612	2648	rundll32.exe	30
PID 2648 wrote to memory of 2612	2648	rundll32.exe	30
PID 2648 wrote to memory of 2612	2648	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Meteos_Test_version_negative_10000.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Meteos_Test_version_negative_10000.7z
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Meteos_Test_version_negative_10000.7z"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a24ead97086f231f28c560b6144b807e

SHA1
a61ce79bcec39a0ab569e477d0f94ab9a1b26955

SHA256
2d1b65e78b68ff9c7dbd00d7942db6522c3f356a099908efa9f977c6816c5674

SHA512
e7fcf1bbf7ae5cfe863a32d104bf21bc4edac566d1a2aa39519aabe2bd5003655bc8a67e86d65810e00cbed03838286efcb94ec09b04da08c2460f45fc519427

Download Submit