1cbdbc2553018d5afbfe7dc7755f54462660a48c6774389e3ee899ead9926f1e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

com/appsflyer/share/LinkGenerator.class
Size

6KB
MD5

5ff93e75b98af96a3234ca8d84f40ccb
SHA1

a8c30344cc095e3e574f88cbd1bdc9a6ccc1c957
SHA256

012c8eae8c8c457a0f150fbd315ca2c1905076107d5a95edd503acfd1799c1db
SHA512

9e0a821d82a3b77affaaea5a2c54b113055bd0665a01c1da1eef94044b5a0308ef5743828d26556be37fa81c5b3d42556e9c26f552ad67dae6c1f5f346050fd7
SSDEEP

96:Y6TD/BeqvIlRyyRy+lchIIYD7Mo/WB88BBoPkbS2BM0EJbnmblkscsmf2SSWZ:16ICMa8BWPFyrUbnAlkdVSWZ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\class_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\class_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.class	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\class_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2696	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2696	AcroRd32.exe
2696	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1816	2888	cmd.exe	29
PID 2888 wrote to memory of 1816	2888	cmd.exe	29
PID 2888 wrote to memory of 1816	2888	cmd.exe	29
PID 1816 wrote to memory of 2696	1816	rundll32.exe	30
PID 1816 wrote to memory of 2696	1816	rundll32.exe	30
PID 1816 wrote to memory of 2696	1816	rundll32.exe	30
PID 1816 wrote to memory of 2696	1816	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\com\appsflyer\share\LinkGenerator.class
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\com\appsflyer\share\LinkGenerator.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\com\appsflyer\share\LinkGenerator.class"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
13ca6fe5f9fcce4a65697b76804f390f

SHA1
c7e5ad7f4e0377d2b1e71f28851328fb76804ab3

SHA256
8cbab1b1a146c571944e0aae22bc5946f8ec43846c7865ae50637d7828e2d647

SHA512
a94307d3c4275f78d984579ba0e713d8e8eb425c8495621f0bb56c8eb8e3777476c2e8de6020715331127e2b10722f0df47ef6fe2ddec3e7ca138ebb5385770d

Download Submit