7965493d62037e1eb29710a6f54ff314663b745c048d5c170239bbddcf12587c

Analysis

max time kernel
601s
max time network
364s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
23/11/2023, 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rules/emerging-ja3.rules
Size

48KB
MD5

d7853a58be243e1f83b979967317ae76
SHA1

fa3506ddf25d464229110869b6d9ac4e2ca9cf59
SHA256

5f3332af41afb496b2f8010a2e784e90c34bef19a658465da3c2bd0fc5c383d8
SHA512

e43f87746167995e9a8c5b1d58c361380723da1d57f68b0bf387f50c9aea10510e33fc5e1ad3e84fbdd7a54f7b327333d0645e61f44be85407d446fe62a78fdf
SSDEEP

768:xPn3TF1IknHtHSd+nF9I2QVJMRke1pAX2b+sa3MXLxJcqVuRyyhbx1iaRQZ0zI+a:xPnBOGNPhLvveFpBLmKD9xQvUPa

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\rules_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\rules_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.rules\ = "rules_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\rules_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\rules_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\rules_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.rules	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\rules_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2992	2788	cmd.exe	29
PID 2788 wrote to memory of 2992	2788	cmd.exe	29
PID 2788 wrote to memory of 2992	2788	cmd.exe	29
PID 2992 wrote to memory of 2588	2992	rundll32.exe	30
PID 2992 wrote to memory of 2588	2992	rundll32.exe	30
PID 2992 wrote to memory of 2588	2992	rundll32.exe	30
PID 2992 wrote to memory of 2588	2992	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\rules\emerging-ja3.rules
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\rules\emerging-ja3.rules
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\rules\emerging-ja3.rules"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
155b8a1e95102711d10949e7329a5989

SHA1
a9de86c630d252644cd5a9dfa4f02358526f9193

SHA256
2b628042237e05bc56e6c702c0adf3de89c8deb13dd3b6b5f5e14feab210f811

SHA512
a3ad4ae3c1bcb50e10534e0bf0d2f9761b8737d4bb2bf40b02e8010d47d7272a6caedca46e9c206990822d4d1de9425f7dd91e46b93b795c55855521e579aabe

Download Submit