e9acb8c841e73fab357ab86cfa122a5193d6562befe71f0dbf7d86ac1b3b0fda

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 01:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

translations/qtbase_de.qm
Size

208KB
MD5

6d8a9cc6f56a598a35a9a61b672f62c4
SHA1

5cb04f893de7abaf95954a6c6bab9ebafd671f27
SHA256

8286eb14d44bb83f869a51feab3e19ab7a9e7756adc8aa103e995a64913f1ed9
SHA512

3af8b4eb00a0155ec44491185b16c7dbc5da43c0c544927172900a22d68cfc88235e5a69d9e9b2d2d0c57a89e1798980104e171cb7f5aaf8762dbd3481103a92
SSDEEP

3072:iLsFuh3JmB8xVXE7YXEfgQZaDMN8DDiEfugwoulh15ce4M+UwsPYXCZPb7Ufq3wy:igFjss86Os/i2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.qm	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.qm\ = "qm_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\qm_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\qm_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\qm_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\qm_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\qm_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\qm_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2600	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2600	AcroRd32.exe
2600	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2616	2996	cmd.exe	29
PID 2996 wrote to memory of 2616	2996	cmd.exe	29
PID 2996 wrote to memory of 2616	2996	cmd.exe	29
PID 2616 wrote to memory of 2600	2616	rundll32.exe	30
PID 2616 wrote to memory of 2600	2616	rundll32.exe	30
PID 2616 wrote to memory of 2600	2616	rundll32.exe	30
PID 2616 wrote to memory of 2600	2616	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\translations\qtbase_de.qm
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\translations\qtbase_de.qm
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\translations\qtbase_de.qm"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
757cd664afd49a8b4832630dc57d7017

SHA1
2e1942456028886147319bcf06438daeb3e93f79

SHA256
945f963dc46cf5e68c9c252d54a574b75319f8e092fc519e3e56a98b496779ec

SHA512
d7d57a6d7e53b5113097ae2c8881c61f618695005b2131dde234f7625756d14ce5edb0a401a5bcc20a6ffb7a722b3d65bb3c47087822d7c782c84db9409c4836

Download Submit