df07d9e692f2bd5d895c928e66df94064057e61987b493a774aab807c7e05980

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

malpedia.bib
Size

5.1MB
MD5

b885fc47e502881c5b5bbc1e96a30621
SHA1

03650923661f551e61608bfff6cd7d07d564fecd
SHA256

df07d9e692f2bd5d895c928e66df94064057e61987b493a774aab807c7e05980
SHA512

d207847277a7413ac70f4fbe6370c29b2eb39c0c7a9e4e15c61eb1b7258e30c6f841800059d472216130687dd438e7677e06f306b0df43365a517aa56c85411a
SSDEEP

49152:Lx3rUQznDncPAdABarrMERsucSbtrKusKknAiQuMAskAnh8:a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\bib_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\bib_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\bib_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\bib_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.bib	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.bib\ = "bib_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\bib_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\bib_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2832	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2832	AcroRd32.exe
2832	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2852	2504	cmd.exe	29
PID 2504 wrote to memory of 2852	2504	cmd.exe	29
PID 2504 wrote to memory of 2852	2504	cmd.exe	29
PID 2852 wrote to memory of 2832	2852	rundll32.exe	30
PID 2852 wrote to memory of 2832	2852	rundll32.exe	30
PID 2852 wrote to memory of 2832	2852	rundll32.exe	30
PID 2852 wrote to memory of 2832	2852	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\malpedia.bib
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\malpedia.bib
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\malpedia.bib"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8221b3b46add1da66fde7f5128971086

SHA1
9fe3f2d4e61e835878507c354f379a08e6c39228

SHA256
74b69e3d119b18530363ca8097dbe64b6eeaf29a343ffa618b734a8bfff4dd43

SHA512
d9dcdfd5b4957e15f82e317df19102a5b1bda074f9d1f161554ca8f60f89244995941471e9ea6cdfd57eed016aea7314bd04a6cee006934c4c37faa7b6f87ff3

Download Submit