96e6276b4d1ff728b1e2014a3be856a5e35a6a885df0797a54728868798feac2

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/models/load.onnx
Size

11.7MB
MD5

d6450245abbd7ad58ae5f1071da48900
SHA1

345acae45cc9e24f9244433ed6027674b9ebc44a
SHA256

d851484492048c5e1504e83da6b31586ced631a19ac8c0e8efa056534384e710
SHA512

192016be0f7edec9715f0a44e44dd2b9d9311551b7491933db258a5ffcc348c6ff5f83d557e23acc8ffd24f6c8f18fc550831738b8f507eb7d5d4f256c096b66
SSDEEP

196608:26SYNg/t+ntY9JMtxQCv1X+c3IDtOVxhkVxQVX25YzXDS4tBgt8V4R2Sq1A1vqrx:cTsnG9qtxQEtlOAjhg4laeBe2N21vq6Q

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\onnx_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\onnx_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\onnx_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\onnx_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.onnx	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.onnx\ = "onnx_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\onnx_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\onnx_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2148	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2148	AcroRd32.exe
2148	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2684	2956	cmd.exe	29
PID 2956 wrote to memory of 2684	2956	cmd.exe	29
PID 2956 wrote to memory of 2684	2956	cmd.exe	29
PID 2684 wrote to memory of 2148	2684	rundll32.exe	30
PID 2684 wrote to memory of 2148	2684	rundll32.exe	30
PID 2684 wrote to memory of 2148	2684	rundll32.exe	30
PID 2684 wrote to memory of 2148	2684	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bin\models\load.onnx
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\bin\models\load.onnx
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bin\models\load.onnx"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c9e4c77aa2cca116004522fef50a4fa1

SHA1
756cfc22e0abaca4f0752b0357a53e44c657d64b

SHA256
70ec531cbacec32cfa38c07b69dddee3840c80b4c202a30c0ceb9adb793fa654

SHA512
cabf8ac2b815979b4113ad0df3d4fe2b726b113c9e4ba3c2c7469cc90655b48f02781cddde02a03c64d1717fc6ba30a773cb55e195a232986a90a3f61e7dc317

Download Submit