1cbdbc2553018d5afbfe7dc7755f54462660a48c6774389e3ee899ead9926f1e

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

com/lovelydast/dating/MainActivity$a.class
Size

739B
MD5

118f14901e83f56441832810c57d27dd
SHA1

b8f9ef0d3287574b057b05a150f8f3de8f2caed5
SHA256

73acbc0b4db948491ca2ee4c2fa33c84516bd5423d5ed13fd771e6c92e27ed7f
SHA512

03f8a662c414ecc20419988d12f401953bfe0207f1960ac6b45b1da2b32b0909b4d306a14d94931b380c4ae2aa884320135dd5f6c62c4cd4a4cec67f2fbb5870

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\class_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.class	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\class_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\class_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2700	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2700	AcroRd32.exe
2700	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2512	2152	cmd.exe	29
PID 2152 wrote to memory of 2512	2152	cmd.exe	29
PID 2152 wrote to memory of 2512	2152	cmd.exe	29
PID 2512 wrote to memory of 2700	2512	rundll32.exe	30
PID 2512 wrote to memory of 2700	2512	rundll32.exe	30
PID 2512 wrote to memory of 2700	2512	rundll32.exe	30
PID 2512 wrote to memory of 2700	2512	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\com\lovelydast\dating\MainActivity$a.class
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\com\lovelydast\dating\MainActivity$a.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\com\lovelydast\dating\MainActivity$a.class"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
78e4e5af49054a2d9164643e5cfa7fe3

SHA1
237fda8b230b6f3227410fed49ab6dcff653ed53

SHA256
9f63eee4de5b23af085e6844ee75b9cd7a2c933e2d59c5067b6e2bb8ca150559

SHA512
79f7e236961052577acaeaaaeeeedb2dadd5f2a4c52bddba0577d6bbb44cd63eca78efb4cc4d1d126187b695670ebebe7f20639aa9b03681543a5174aa137251

Download Submit