05cb23ac804ab1c484ec3cd406d10c4a0a4f3b70a0e0c41111819e61226711b5

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

export.r2x
Size

681B
MD5

2d1261add8043a3f6d6e51decfc7fb26
SHA1

e898a15e824fe71efe6fed73ddd22b7d53b70b99
SHA256

dcc79ebaf51164be680d48f8c02253977eb11c6e1e4989785e0c4291c9fe936f
SHA512

a77d08b61da86f94307a5705b383f7aa8cdb547e7d1753559691347ecbf45d2ebcad0388a46dab91b504f7d52db67658906f193c2f60b9871101bbbd8b82f422

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.r2x\ = "r2x_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\r2x_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\r2x_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\r2x_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\r2x_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.r2x	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\r2x_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\r2x_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3056	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1756	2536	cmd.exe	29
PID 2536 wrote to memory of 1756	2536	cmd.exe	29
PID 2536 wrote to memory of 1756	2536	cmd.exe	29
PID 1756 wrote to memory of 3056	1756	rundll32.exe	30
PID 1756 wrote to memory of 3056	1756	rundll32.exe	30
PID 1756 wrote to memory of 3056	1756	rundll32.exe	30
PID 1756 wrote to memory of 3056	1756	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\export.r2x
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\export.r2x
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\export.r2x"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3056

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e0523aca58c26dbbdac2aedf02bd0e61

SHA1
b101b0f369cadd022c497d4c551c56f55674b445

SHA256
7625c246c3d5a88c91aca1e883ca38918a24c0e8a3e70769fe122577dace133d

SHA512
fc2b83b717c5776351a319cd5be6f0bfefe0146f9c560081c1b4df61923f04182d43afe89204f7493ff87d03a5bb89b3885386d3cc540753a056c454a8200994

Download Submit