1cbdbc2553018d5afbfe7dc7755f54462660a48c6774389e3ee899ead9926f1e

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

com/appsflyer/oaid/R$style.class
Size

21KB
MD5

baa90bc0cfd599b75b3f2aaa23bf7b3d
SHA1

a17efa9f29723ab49a9fc449e292a3d582f00cea
SHA256

0cfec876b82d1e0bdc35434dbf1d32821fdf6f42863073576cead4ca2d691c8b
SHA512

d7b018bcdbac4e2820b259b863a9136ed1aeff996725189f64062690cfb4e0266ca9a5c974dc7d5396d9186184f915c76e27bc7e1db7abdbb4ba9b1a7e147247
SSDEEP

96:DQdI+gvMdB888F8b6sQRoMLSGyCLARt+23CfiNmVG8X8o858Zjku/P0YTZQVds62:Uek6P/ARt+Nid1mDpKfkgjmJwe0Ce+0E

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.class	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\class_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\class_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\class_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2596	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2596	AcroRd32.exe
2596	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2552	2312	cmd.exe	29
PID 2312 wrote to memory of 2552	2312	cmd.exe	29
PID 2312 wrote to memory of 2552	2312	cmd.exe	29
PID 2552 wrote to memory of 2596	2552	rundll32.exe	30
PID 2552 wrote to memory of 2596	2552	rundll32.exe	30
PID 2552 wrote to memory of 2596	2552	rundll32.exe	30
PID 2552 wrote to memory of 2596	2552	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\com\appsflyer\oaid\R$style.class
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\com\appsflyer\oaid\R$style.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\com\appsflyer\oaid\R$style.class"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fa117a603d0487e0a60d5a4d0dddfeb8

SHA1
fd5a289ce9a874fa0487c577cac7d5c9d5d7010f

SHA256
17fd6039afcda67a734a3281a1a0a2e826945b1d1376796b44287e81dbbd109d

SHA512
6fa60ae163e2af7e4a136b5fdb996e65cb6efe9cb9e122baf42baeab65575902dd26afad6300d6759b7dea6ae2e6a8924501ab256476ee3f90544038c78a2d6b

Download Submit