852c6a6dc44f89ab993c6e9bf1177b021e63597f82c3ff5136d4e8fe358d5d42

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Revenge Launcher.xar
Size

50.9MB
MD5

c9ed265cb2fb64953333825a86759347
SHA1

c1b4b5450ea3d96eeebe56d972de03c3ad90f575
SHA256

852c6a6dc44f89ab993c6e9bf1177b021e63597f82c3ff5136d4e8fe358d5d42
SHA512

02dd8c10a1a094f000b9d0716be965d15c2b1668a1b30e103c4178e9daafacc563820911848bf9a22e4851811da7c14a2e029abe1e7ea5df6ad605c0f0c2c2cc
SSDEEP

1572864:TMLUZrNdn4ihGLQQg7JJvriPwrrzfl2aTdM:wWrJoMQCJxGPwr/bTq

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\xar_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\xar_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\xar_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.xar\ = "xar_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.xar	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\xar_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\xar_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\xar_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2604	AcroRd32.exe
2604	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2824	2184	cmd.exe	29
PID 2184 wrote to memory of 2824	2184	cmd.exe	29
PID 2184 wrote to memory of 2824	2184	cmd.exe	29
PID 2824 wrote to memory of 2604	2824	rundll32.exe	30
PID 2824 wrote to memory of 2604	2824	rundll32.exe	30
PID 2824 wrote to memory of 2604	2824	rundll32.exe	30
PID 2824 wrote to memory of 2604	2824	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Revenge Launcher.xar"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Revenge Launcher.xar
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Revenge Launcher.xar"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
51d3d7b9094b3338ed1da5992e067c51

SHA1
0d9254567a0ecd176d34a37652be22874e5489b4

SHA256
32bfa33308e5432795003dda06590c3cfa9b5e01fed9eea7e4039312f8e7f0d3

SHA512
80db0a7ce2a7dc895aa61448e18965a94702cdfc5e0288832f2be8c2d75fe9498b30c11502085a5ac68a087aaf74f915ca65c8c39c1b194d3320067d5c35614c

Download Submit