329db242a00f0dcf4e2f6390b06c837fd992cabb2cc4d0eda8278a8c57d4b044

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/02/2024, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2023-10-12-encoded-binary-retrieved-by-au3-script.bin
Size 388KB
Sample240207-drfp6scbb6
SHA256 307e554435ba5edc9c2b1d11e940d5656f748bd399465ae05dfc4a40e30a363f
MD5 428a589184fdee0acc2906261fa0c579
SHA1 cae63c6f8fbfedfa59c50e06881371209b1b4171
SHA512 ee513cf78a115224a2650fdc22a87102da96ea5e573e296908bbeb636e9f33675ef3bbe9707239548d0cc028043c64ab1112e52ddd6c28b12dfbf6924d604514
SSDEEP 12288:6mK3FJgNdwR8mNaR3Ntc0fYlP28FmihtI:7K3FUi8mNOt1fYM8he
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\bin_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\bin_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\bin_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.bin	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.bin\ = "bin_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\bin_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\bin_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2284	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2284	AcroRd32.exe
2284	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2824	2248	cmd.exe	29
PID 2248 wrote to memory of 2824	2248	cmd.exe	29
PID 2248 wrote to memory of 2824	2248	cmd.exe	29
PID 2824 wrote to memory of 2284	2824	rundll32.exe	30
PID 2824 wrote to memory of 2284	2824	rundll32.exe	30
PID 2824 wrote to memory of 2284	2824	rundll32.exe	30
PID 2824 wrote to memory of 2284	2824	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2023-10-12-encoded-binary-retrieved-by-au3-script.bin
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\2023-10-12-encoded-binary-retrieved-by-au3-script.bin
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2023-10-12-encoded-binary-retrieved-by-au3-script.bin"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 a4a7f69c5af3f56bd54763a53d8a795583bc9955ed0c2629ec45c5586305fb9a
MD5 2e7b2970744f59e94612e0ed2a834c17
SHA1 525536a235f814a7b4f1c78ef32b4296413e44b0
SHA512 d68f1b360c61cc1d022186b368bd87aabf76c21a294c9841370e6fe150044a901759cfee5f5eecaeea887777d407a4cbb6e0bdf46fea06ab84dedc578fe7d9d6
MD5 SHA1 SHA512

Submit Download