3caa7e5f3acd124de99d931f6044a67868e716235463ac7d5d6bd6be69aa48b5

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01 NOTIFICACION DEMANDA/fascinator.psd
Size

517KB
MD5

41ed9f6378365fa37addbe5503911712
SHA1

8ef5324560d71fd78ec08bd6c7c15d8285f573ae
SHA256

43f2fb19d5d22b02465b8147d4dfff119bbdfa81feac91403827c2aa71c11175
SHA512

5c157a826c1373fc127ea521e515a382dd425aa586590dd15ada3e48f2542e2f425be504081305b2addec5e0470bda876cd0b522fb09ac0e1effb91ceb80dbc5
SSDEEP

12288:2zzr/LD73DyRZh8mwvEWyA5n/h/UqAljg4DW:2zPL/3DyRZh8jvE3o/h/AGAW

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\psd_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.psd	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.psd\ = "psd_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\psd_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\psd_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\psd_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\psd_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\psd_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3004	AcroRd32.exe
3004	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 3020	2420	cmd.exe	29
PID 2420 wrote to memory of 3020	2420	cmd.exe	29
PID 2420 wrote to memory of 3020	2420	cmd.exe	29
PID 3020 wrote to memory of 3004	3020	rundll32.exe	30
PID 3020 wrote to memory of 3004	3020	rundll32.exe	30
PID 3020 wrote to memory of 3004	3020	rundll32.exe	30
PID 3020 wrote to memory of 3004	3020	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\01 NOTIFICACION DEMANDA\fascinator.psd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\01 NOTIFICACION DEMANDA\fascinator.psd
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\01 NOTIFICACION DEMANDA\fascinator.psd"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
93f6901245355a211b34ab8427cc1971

SHA1
bd203414d5637a1d0297755dcbf11f667bcf27a4

SHA256
0b85e944fb5d82f05e91e2d5ddb71eab4696179c765ec48b96396f76526e7125

SHA512
969bcc0dcd2dc0d0199d239b2c315d6be0e6da1378ff1cf77d996159177d3290fb179c0c55b618b78ede7d4d96ab55568d6906d0096b6073904991055eb59705

Download Submit