4a2f2033ba41e8a49e578b75f2b91861889ffea0444a8b58b3a816569acbe6bd

Analysis

max time kernel
1803s
max time network
1819s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AJPB015ME3MV3HSTMFLY.temp
Size

7KB
MD5

bdd4c50d0bb6f987f7b349ba1f689d89
SHA1

8ceb59c38417ebcc1007eda1eaea2eaa4413f33a
SHA256

4a2f2033ba41e8a49e578b75f2b91861889ffea0444a8b58b3a816569acbe6bd
SHA512

f4d27a8c91508a3bd53d982ba104cac7bcf9b9d8380a4019b473c85b2f7dc22c49805515204e42d2974cf84e08e9ce8d775697fc536158ec52dd84c741591941
SSDEEP

96:YFTOCZM8QnqvsqvJCwoiFTOCZM8QnqvsEHyqvJCworWoqgQHvL7jLXlUV5:UTHkUoSTHkAHnorWqWL7jLW

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\temp_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\.temp\ = "temp_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\temp_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\temp_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\temp_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\temp_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\.temp	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\temp_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2840	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2840	AcroRd32.exe
2840	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2788	1116	cmd.exe	29
PID 1116 wrote to memory of 2788	1116	cmd.exe	29
PID 1116 wrote to memory of 2788	1116	cmd.exe	29
PID 2788 wrote to memory of 2840	2788	rundll32.exe	30
PID 2788 wrote to memory of 2840	2788	rundll32.exe	30
PID 2788 wrote to memory of 2840	2788	rundll32.exe	30
PID 2788 wrote to memory of 2840	2788	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AJPB015ME3MV3HSTMFLY.temp
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AJPB015ME3MV3HSTMFLY.temp
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AJPB015ME3MV3HSTMFLY.temp"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f7b76b6d8ce9b9bd310c3ef35151b3cd

SHA1
81f2706f206939a4f4d7f962fbca8944aa7d8e55

SHA256
4a51e10b0cb6c4a932da3d0848f70f8fe9f9403b1689559e34e99e9fcce22931

SHA512
211ab764aa23e09eb192436add59dffb8c7dc23ec8339b401da8ba37250dbaa504710887f2cda37c420f6a3a59cbc0d203297abc44ec7038a4f50d8ef4192d78

Download Submit