7965493d62037e1eb29710a6f54ff314663b745c048d5c170239bbddcf12587c

Analysis

max time kernel
603s
max time network
367s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
23/11/2023, 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

emerging.rules.tar
Size

34.1MB
MD5

7f09104226b9a2ce3e90bf1db2f0390d
SHA1

9e32c5c0b5e68df843d37115f9524a675a37cf0b
SHA256

b9c70c23bdd4f3b4ec8ac70d1649f5776ad111de40e868a9405a1de570782866
SHA512

962fccef99bd92c91511c95a65d12c24a37a47e9d3c749bfb9d4d4f54ff4ba540dcafe255243c4cfba5d9ae5f129e06f28c1756c8d0419d295e76557ecaa6d64
SSDEEP

49152:+fjNiSUU8KwR42CZyaHpbzMqbCSh9uvYwd/Y4ckBrFWzAOOubzq4FyvhatVmCvNO:+bNt6UCfDkVmCvN4AY2YS1fM8ex

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\tar_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\tar_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\tar_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\tar_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\.tar	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\tar_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\.tar\ = "tar_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\tar_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2708	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3052	2236	cmd.exe	29
PID 2236 wrote to memory of 3052	2236	cmd.exe	29
PID 2236 wrote to memory of 3052	2236	cmd.exe	29
PID 3052 wrote to memory of 2708	3052	rundll32.exe	30
PID 3052 wrote to memory of 2708	3052	rundll32.exe	30
PID 3052 wrote to memory of 2708	3052	rundll32.exe	30
PID 3052 wrote to memory of 2708	3052	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\emerging.rules.tar
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\emerging.rules.tar
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\emerging.rules.tar"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f4f370118e84547fd6cf55c5aa8515ba

SHA1
aa00f5370df360d98be6a4cadc919e525d3c2385

SHA256
f529eea80589b495dfa0f285464d733baec6227deb7a9a20497cf55f11e50281

SHA512
6ec109cc571e2a543935b26c2f75db4f04f860ac4c661ca609abe37a2f7811d91c05fdaf6f38349e79bbd0dc29eab905135104b74e223e93bde55260e74bf700

Download Submit