4d63caee8d2c5e50ebb220e6aa593fe852a516e209006ba0a16507907125f46c

Analysis

max time kernel
180s
max time network
69s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

appbackgroundstheme2d.manifest
Size

706B
MD5

e5096acb6a9aae8cb8b048e7b790cb3f
SHA1

22fc9e1dc3a9ae1f84e5d4fc595003e72fb34ab3
SHA256

1543be44f9f641cfa511b38fd79d81e977400c4a72d77aa9d089353e5669067b
SHA512

83babe30b1cfb53579f573118c170e461b61b7edef2c0095e24d8d0d395b760fe248a983184037638e4667a0a0710a752ef17b7f28ee83a9738024ec731769aa

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\manifest_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\manifest_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\.manifest\ = "manifest_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\manifest_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\manifest_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\.manifest	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\manifest_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\manifest_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2748	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2748	AcroRd32.exe
2748	AcroRd32.exe
2748	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 1020	2720	cmd.exe	30
PID 2720 wrote to memory of 1020	2720	cmd.exe	30
PID 2720 wrote to memory of 1020	2720	cmd.exe	30
PID 1020 wrote to memory of 2748	1020	rundll32.exe	31
PID 1020 wrote to memory of 2748	1020	rundll32.exe	31
PID 1020 wrote to memory of 2748	1020	rundll32.exe	31
PID 1020 wrote to memory of 2748	1020	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\appbackgroundstheme2d.manifest
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\appbackgroundstheme2d.manifest
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\appbackgroundstheme2d.manifest"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0378b292eecc211a2353a53b86327531

SHA1
34ce5133e0518f5ff75cd04848f6c3855c6fba26

SHA256
9e3ac7adb2dfe32616aaf0260914024e0793da52577ebd2875d61353511d2b91

SHA512
424e4bc21fa8a9e206001778aead5fc0991e4d649a1501d1de63821c1eeddd64b24eb9bb8413177fcfb4eb23e354ee21c5f69ba42e32e7bd5e769bbd125f3b37

Download Submit