96e6276b4d1ff728b1e2014a3be856a5e35a6a885df0797a54728868798feac2

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Accord.dll.config
Size

213B
MD5

08a09a4c92f3b8a8ad1b1c268049bea1
SHA1

5ad3f318e9e5470db33e3080e864f887063fcc5f
SHA256

3049e83f9b7fa9285a82fb3c7740e9c225b66a31f805d3582a9bfd34b5dd8e6e
SHA512

ebb465a0ccc5a001eb23357ee0807f86b9bb92b285340a6679dd42eb6efe15fd4b965f44a7e9c3115aaa51f777415ee37152ea9c9e73f749538c170f8b84ab64

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2656	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2656	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2656	AcroRd32.exe
2656	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2656	2084	cmd.exe	29
PID 2084 wrote to memory of 2656	2084	cmd.exe	29
PID 2084 wrote to memory of 2656	2084	cmd.exe	29
PID 2084 wrote to memory of 2656	2084	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Accord.dll.config
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Accord.dll.config"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
30998380c18e84fcf7068556d5e9b39b

SHA1
4a538daa3f727be2ce26d71a37b6cd7e43a399c0

SHA256
4c2c7968b92b11b8ed9c3cc5e71d4dab75536f21f35918a33f292f2b27262ee4

SHA512
c225e97cd0070df4d60d782216c52ce642a145b4cf739fadb15e87680a534fe93bd016c5414e0cf089a453b55099170a147ad57e0bca52557cb46d1f08082e7c

Download Submit