1cbdbc2553018d5afbfe7dc7755f54462660a48c6774389e3ee899ead9926f1e

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

com/appsflyer/oaid/R$dimen.class
Size

6KB
MD5

6f566343944c309e072a56db95885ea9
SHA1

4dded3d7e645d44073f0ff57619aa283073eb476
SHA256

31bc8d0f7cb16c92402e82f27cddc0db115717bf278992470f754112766f1092
SHA512

bb0d48f084adad1e160a14e74144ccedc3aa2f091a6d9f8d8da46f56302cad36e1ee74b4e38426333b8da7fddc5af63b1564996791f67ff85d5d7b9bcbc7eac3
SSDEEP

192:gIjmBfC7/43zMvV8lZSLGiWDy5TdZLUpBjC8fctX8GLCvtcNc/:aY46OlZSLGiWDy5TrLUTjCdCv/

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.class	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\class_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\class_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\class_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2796	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2796	AcroRd32.exe
2796	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 3020	1668	cmd.exe	29
PID 1668 wrote to memory of 3020	1668	cmd.exe	29
PID 1668 wrote to memory of 3020	1668	cmd.exe	29
PID 3020 wrote to memory of 2796	3020	rundll32.exe	30
PID 3020 wrote to memory of 2796	3020	rundll32.exe	30
PID 3020 wrote to memory of 2796	3020	rundll32.exe	30
PID 3020 wrote to memory of 2796	3020	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\com\appsflyer\oaid\R$dimen.class
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\com\appsflyer\oaid\R$dimen.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\com\appsflyer\oaid\R$dimen.class"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9b974e95cdcadcd45226be916c2b91e0

SHA1
d64c804892ff8b1683c7c3a956e6bf0086c83bfb

SHA256
48fded89b86a25f49e7a864f687dff098ca7250bdb24b82625a039413194a0ca

SHA512
2c892e0b87aaa52222940a91da44f13059297ff2722af5cce8517aa6bc60def6f2eb31ecb794f5ebed0d9b5355cc80ba3677212badfddf09a8531836766717bb

Download Submit