bf2ca3f940fe084a409d7889de8b32b29842106b5112684e0c98facf9300bb9d

Analysis

max time kernel
578s
max time network
621s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 20:14

Target

IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)/cfg/tms32028.cfg
Size

463B
MD5

c84e93e2663ea09e550ae7cfdb5c5f9a
SHA1

807e37207331a1ef8d6fdb341de5bcc3fe3375d0
SHA256

d9eeafb2ad99f55d821377618c9c30546a27046b0ae05ad1de46a863d1886ed0
SHA512

17b0c52df2e4d763ef4d259c1591ff22fe6236de98aaf0083bbe93d42a94fa44e147c27a5deaf6407475bb977cc99f8cf54d2a58c183468085b89f2c5618c848

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.cfg\ = "cfg_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\cfg_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\cfg_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\cfg_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.cfg	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\cfg_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\cfg_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\cfg_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

3032 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

3032 AcroRd32.exe
3032 AcroRd32.exe

pid	process
3032	AcroRd32.exe

pid	process
3032	AcroRd32.exe
3032	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2684 wrote to memory of 2588	2684	cmd.exe	rundll32.exe
PID 2684 wrote to memory of 2588	2684	cmd.exe	rundll32.exe
PID 2684 wrote to memory of 2588	2684	cmd.exe	rundll32.exe
PID 2588 wrote to memory of 3032	2588	rundll32.exe	AcroRd32.exe
PID 2588 wrote to memory of 3032	2588	rundll32.exe	AcroRd32.exe
PID 2588 wrote to memory of 3032	2588	rundll32.exe	AcroRd32.exe
PID 2588 wrote to memory of 3032	2588	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\cfg\tms32028.cfg"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\cfg\tms32028.cfg
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\cfg\tms32028.cfg"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3032

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
43cd20df204a33a9aa29428949cafa2c

SHA1
08c908ec3abc2da40083ed64d56fe7bfd24e2edd

SHA256
b19519f5532dd0f78fca048f79125522dea14171bf48c9a0adb54bc79dce1f82

SHA512
df9af0853856aa3255604b2dd1ba49cb7b63d928d77d4cb1ec6944b1e192e875468fc615b0a01f8835be1574f3ad96bd80cca403fee1d9af66fc847e80ca399f

Download Submit