fcee982b3d0e1601b40078d98df03503668aec7542721f921ae8248bc3cec3a1

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-de
resource tags

arch:x64arch:x86image:win7-20231129-delocale:de-deos:windows7-x64systemwindows
submitted
31-01-2024 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Elite.apk
Size

533KB
MD5

9f01767647e2e72f446d374bbcb20c53
SHA1

f6b1adcd7723b525418a05bcede5c671366d7ab3
SHA256

fcee982b3d0e1601b40078d98df03503668aec7542721f921ae8248bc3cec3a1
SHA512

4b9dc2dc08f015ed96a3ce30978994314d3edca84348eb62e7cb65d4d5477f179c44c80cc0a67863bc119555d0217f57681d047ce98ec405bd5eeaf2da8280ed
SSDEEP

12288:kjRH6+O//n3tKpSsM+1HA+x283ecVS3EVqPlR6i0Ci3jM34D9Z:kN6+ONjstg38OOS3EW6i0C+M3SZ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\apk_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\apk_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\apk_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\apk_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.apk\ = "apk_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.apk	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\apk_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\apk_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2688 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2688 AcroRd32.exe
2688 AcroRd32.exe

pid	process
2688	AcroRd32.exe

pid	process
2688	AcroRd32.exe
2688	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1616 wrote to memory of 2664	1616	cmd.exe	rundll32.exe
PID 1616 wrote to memory of 2664	1616	cmd.exe	rundll32.exe
PID 1616 wrote to memory of 2664	1616	cmd.exe	rundll32.exe
PID 2664 wrote to memory of 2688	2664	rundll32.exe	AcroRd32.exe
PID 2664 wrote to memory of 2688	2664	rundll32.exe	AcroRd32.exe
PID 2664 wrote to memory of 2688	2664	rundll32.exe	AcroRd32.exe
PID 2664 wrote to memory of 2688	2664	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Elite.apk
1⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Elite.apk
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2664

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Elite.apk"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2688

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
a78d7765bec7e21d0f8d43aac9f364ea

SHA1
3d01101f71702a72c75794b039ef5e3c4e3d0bbd

SHA256
5145fbcbad83c0a84ea12b0b47330995bd3bbfe44b8ff50abd710b8f24e5585d

SHA512
5e58d7c54761885c5bd6f61eca0c07c7a18b038663c6222f0e7398644904758234fe2971253233275fe6108ed7fb5a8de99fbf12db1155d20b4a2737302af666

Download Submit