3b532a3091891c7e4e8c96277d52bb9bc1cb11eea7da2f1d9175e5383af6e16f

Resubmissions

27-11-2023 15:53

231127-tbnzlshf3y 7

27-11-2023 15:49

231127-s9blhahf28 3

Analysis

max time kernel
163s
max time network
139s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
27-11-2023 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PlatformContent/pc/textures/water/normal_15.dds
Size

85KB
MD5

ff6b24259811f3549f984bdf99d6e167
SHA1

afb7c17160a81b8eeb326c7a59bf20b6f45b2787
SHA256

f5a39da6a07b5a6421d0b4c2e03891bb63d114f585bfd703daaf694177a79478
SHA512

c97693afde4aea9c181357b36faacad63d2a813447e7d0288aeaf5fc98b4a1dd6a0eeb688e7d0b7441be9290da2c8c8eb12a260abde2be8f05f11643fad109f9
SSDEEP

1536:53chDnxoD152ryjnvlUK176onC1ELK41rrlWaE45/gb+dF8fqENBliS:5shDS1WeCo+PtGRWaR5s+PuPX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\.dds\ = "dds_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\dds_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\dds_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\dds_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\dds_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\.dds	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\dds_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\dds_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2072	AcroRd32.exe
2072	AcroRd32.exe
2072	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2840	3048	cmd.exe	29
PID 3048 wrote to memory of 2840	3048	cmd.exe	29
PID 3048 wrote to memory of 2840	3048	cmd.exe	29
PID 2840 wrote to memory of 2072	2840	rundll32.exe	33
PID 2840 wrote to memory of 2072	2840	rundll32.exe	33
PID 2840 wrote to memory of 2072	2840	rundll32.exe	33
PID 2840 wrote to memory of 2072	2840	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PlatformContent\pc\textures\water\normal_15.dds
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PlatformContent\pc\textures\water\normal_15.dds
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PlatformContent\pc\textures\water\normal_15.dds"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
adeb1c5c8b37b10fc8a67421e0fa478d

SHA1
ed76d3b901b2c88b8a07495b3644b8234edc8093

SHA256
9d4835f4c6dd67702e9df3eed2b81bf5ad3db4912a314682e2db902fc0fc25cf

SHA512
4696122185d5258d8d7ba3d94f8a33ca2ba7e1e9b6acd79eaa9378220dce2a2aae4a59cf14e75c3e7aaa5acf8a1ef5e8736324ffbc21bb8f1bde5284fab490e3

Download Submit