489485f76c425b348691243b18355c39990c477483b8f2eca99d9df8225ba3f9

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
brandesianerens.deb
Size 123KB
Sample240125-xwpcnaecgn
SHA256 ed1a8fd830e609d77d9cd8548aee9a4b48c241957bf115af74bad4704521bd13
MD5 028b5eb62c200230ac769a5f6bd9ea5b
SHA1 8ae510f1b5cfc1a33596db3382eda9a7f608e87a
SHA512 5ec2346861b7732f94fedb0ae3a8eca6fad2160da353e845bfab98b1a3c00ccbc01ae745de1edd262eb68b190dc16a05fd2daf4c65c71bcf741db68381fa76cf
SSDEEP 768:zAAuS8ZPYv8e9+34Yo9pOde9wHwEE8ptuV/uXpKBajfLqLa:gHI9Fy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\deb_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.deb\ = "deb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\deb_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\deb_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\deb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\deb_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.deb	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\deb_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2612	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2612	AcroRd32.exe
2612	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2580	2244	cmd.exe	29
PID 2244 wrote to memory of 2580	2244	cmd.exe	29
PID 2244 wrote to memory of 2580	2244	cmd.exe	29
PID 2580 wrote to memory of 2612	2580	rundll32.exe	30
PID 2580 wrote to memory of 2612	2580	rundll32.exe	30
PID 2580 wrote to memory of 2612	2580	rundll32.exe	30
PID 2580 wrote to memory of 2612	2580	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\brandesianerens.deb
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\brandesianerens.deb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\brandesianerens.deb"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 b5a1a78eb61ce5a0f04c421ae3bf06705f2095f2b293ceedadd0d5567e1c8884
MD5 fecbcce263a212fc204f5e8762a3dd28
SHA1 3a648487d105d8f5932270b43ddd8a0b62bb165d
SHA512 52bae09538b0a6236841ca378755843a73c66748d52dc87c6d6c6b5b62da9d8b2074c09be66b20d0360db9408453e34c8487a4c25f60dd27a350a682d9a70350
MD5 SHA1 SHA512

Submit Download