7965493d62037e1eb29710a6f54ff314663b745c048d5c170239bbddcf12587c

Analysis

max time kernel
601s
max time network
362s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23/11/2023, 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rules/emerging-mobile_malware.rules
Size

718KB
MD5

dbe98a121492ada78b6a5c3debe51e29
SHA1

fa85368f29b620bb22c9528a5c07db91ecfd69a1
SHA256

51846b2b0a2163944cacba2373f16ae9c78eddd0745395e7a52ea30436958f76
SHA512

164943ee678d5558f4345cbede793cbd8a8fd1c717413be4350f90829e2f68b66f73c5f3b027573c286db9186d3b19a4f0cbea70e7926652b5ce7b74db7d2d6f
SSDEEP

3072:pnT7CubnfDrct2bSlQY5B0gWQVeeBh+birJi1J1iP0m+D/O:t7CubFeBw/O

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\rules_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\rules_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\.rules	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\.rules\ = "rules_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\rules_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\rules_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\rules_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\rules_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2680	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2712	2128	cmd.exe	29
PID 2128 wrote to memory of 2712	2128	cmd.exe	29
PID 2128 wrote to memory of 2712	2128	cmd.exe	29
PID 2712 wrote to memory of 2680	2712	rundll32.exe	30
PID 2712 wrote to memory of 2680	2712	rundll32.exe	30
PID 2712 wrote to memory of 2680	2712	rundll32.exe	30
PID 2712 wrote to memory of 2680	2712	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\rules\emerging-mobile_malware.rules
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\rules\emerging-mobile_malware.rules
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\rules\emerging-mobile_malware.rules"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a996e7591b153cc4ad870b8ace18c5c1

SHA1
d6dfeff9ecfe3645b725ef6c0bea8188394c3d6f

SHA256
77b5598f00090348523158baff568d7baf02e1d0aaaead7cc0065619623f859c

SHA512
5dd713d8c8dcc9d71de4b40a80da0e771bde119c20dfaf2a1c75f19cfb0afbfdd006946fb75d303dadfab67a92efd6b2a1f36a800be7e0b0503a168d8d9aa2cb

Download Submit