254c47277797a8913ee9e13a2272bea90551e625e5813541c2838ab6f1536eed

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 02:42

Target

IFProtects/lWAbout/IWAbout.exe
Size

754KB
MD5

fda866e7a42e3432c3ac089b4fbac286
SHA1

410b9deef188cb8229f18aaba9a3908e1da12ba6
SHA256

8840dcc3c2da8f3465b5bdc7d9cdaf824f95afbe3d037cc277de84079afa8b04
SHA512

d7fa58a8d9af4d71f3d9123f47a5e81b412d824977d05fcada8b76abea79a9d634b0e3bad0d731828a927d9824357953770c8992ddaaaffca8074cd49766b44a
SSDEEP

12288:esgaRhSHo7x9EA5hChGtvKP9ID6v3QD4o4jMdC4i97db4+N22zIxUK+XvfS2ajs:eG9vrvZD6vgD4o4jMdC4i97db4+N2Jxo

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2500	IWAbout.exe
2500	IWAbout.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2756	AcroRd32.exe
2756	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2756	2672	rundll32.exe	30
PID 2672 wrote to memory of 2756	2672	rundll32.exe	30
PID 2672 wrote to memory of 2756	2672	rundll32.exe	30
PID 2672 wrote to memory of 2756	2672	rundll32.exe	30

C:\Users\Admin\AppData\Local\Temp\IFProtects\lWAbout\IWAbout.exe
"C:\Users\Admin\AppData\Local\Temp\IFProtects\lWAbout\IWAbout.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2500

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6610eb24196180c7874052a6701a5172

SHA1
8658ca5641fce30340d386964526fe08d2c204de

SHA256
16075e692b6b76c37fa0dc53ad2caf3b41a42020695c88c0ba13a889a2833d86

SHA512
1153f21d99e9d2a70a1a4e5bfff45756a7448e5c5a95cfe3841fabd1eadbde375e34eb0af8aee4c69f952f4727ace62e3fdc99d5c621a64576f1ae0a35da4140

Download Submit
memory/2500-0-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2500-1-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/2500-2-0x0000000050000000-0x0000000050117000-memory.dmp

Filesize
1.1MB

Download
memory/2500-3-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/2500-4-0x0000000050120000-0x000000005030E000-memory.dmp

Filesize
1.9MB

Download
memory/2500-5-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/2500-6-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/2500-7-0x0000000057800000-0x0000000057812000-memory.dmp

Filesize
72KB

Download
memory/2500-9-0x0000000050000000-0x0000000050117000-memory.dmp

Filesize
1.1MB

Download
memory/2500-8-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download