fd0bfdbbdc7800cfa6f433ace80cf67f6f6c22f04d0d386e4d2ebd987ae87e33

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Virus.AIDS.a
Size

13KB
MD5

2e9ff23c679aab77e95ad42e8563dd66
SHA1

4cee0c2dc614f415566746b676d278054fddd347
SHA256

d896f0e5d0e23ae5eab6014db6950067bf48ff6ae12305fbd87e1f2bd239e733
SHA512

a660c88d04663544be95926aeafe1a2d9cd1e39e9b00b88ff3fa9db80fb460c28eccd6f4a7a8f14e65946737f81c79a9890879d0920b30739df76205dc9ce06a
SSDEEP

192:rOFVaiPxymaBWEqLQQTDDThYyZuAby2IM0MIJ2Jw55eDyp3sa4Ni:iFE6MmMRxQDThYyAf2kMIJB55Qy13j

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.a	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.a\ = "a_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\a_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\a_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\a_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\a_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\a_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\a_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2360	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2360	AcroRd32.exe
2360	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2820	2232	cmd.exe	29
PID 2232 wrote to memory of 2820	2232	cmd.exe	29
PID 2232 wrote to memory of 2820	2232	cmd.exe	29
PID 2820 wrote to memory of 2360	2820	rundll32.exe	30
PID 2820 wrote to memory of 2360	2820	rundll32.exe	30
PID 2820 wrote to memory of 2360	2820	rundll32.exe	30
PID 2820 wrote to memory of 2360	2820	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Virus.AIDS.a
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Virus.AIDS.a
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Virus.AIDS.a"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
70386eab503cc794522c6b5558d4a62e

SHA1
4da10cd2c186ea19868ed175c103b88de6b98bcb

SHA256
1e883d87ebe30c8fd022c37d7ff7c6857fd69c8ed8351dcfef6e33b080a0daee

SHA512
066134106d2520cc186f5a174a96b4c3ea2380d2f68aef98b804677ed5b5a5eb1421ad2873257bc09764594e929ad53710d487457a2fa2462dcf33be7129f78f

Download Submit