d8f54575aff075268200250b3ed4af1da894db2199432b7110605003c6afba4a

Resubmissions

17/05/2024, 14:16

240517-rlfd4sbe59

07/02/2024, 13:21

240207-qlmmrahhgr6

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2024, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
220509 - (Cabinet Meeting 2022)/Increasingly confident US is baiting China.exe
Size 397KB
Sample240207-qlmmrahhgr
SHA256 4761183bc8bff993a5551916eda73c84bb8f9eadd24c4c19587045bb91609a83
MD5 c751af3a2b5e5085e0cf4a66a09480d9
SHA1 0d451c8ee760d3fdf1233b44b657dc10e0450bb6
SHA512 bd88ea76db942b4fd865ed986be75d6df6a90d10f3600a4c3f330a0d7935b1906b536a2eb2cc0211dd199bf2a37440d0a8febbbe6c6ad9b9027e6e59c9511e01
SSDEEP 12288:n5RmQFpKMFeO7Blp/B8Z7QZLJZpT6672GbziER839l/d6LYE2B38jqLX:Z/l839l/ooEC
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Graphics = "Rundll32.exe SHELL32.DLL,ShellExec_RunDLL C:\\Users\\Public\\Libraries\\Graphics\\AdobeLicensing.exe"	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
1864	AdobeLicensing.exe
4476	AdobeLicensing.exe

Loads dropped DLL 2 IoCs

pid	Process
1864	AdobeLicensing.exe
4476	AdobeLicensing.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
860	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3660	reg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3660	5016	cmd.exe	87
PID 5016 wrote to memory of 3660	5016	cmd.exe	87
PID 5016 wrote to memory of 3660	5016	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\220509 - (Cabinet Meeting 2022)\Increasingly confident US is baiting China.exe
"C:\Users\Admin\AppData\Local\Temp\220509 - (Cabinet Meeting 2022)\Increasingly confident US is baiting China.exe"
1⤵
PID:1352
- C:\Windows\SysWOW64\schtasks.exe
  /F /Create /TN Microsoft_Licensing /sc minute /MO 1 /TR C:\Users\Public\Libraries\Graphics\AdobeLicensing.exe
  2⤵
  - Creates scheduled task(s)
  PID:860
- C:\Windows\SysWOW64\cmd.exe
  /C reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Graphics /t REG_SZ /d "Rundll32.exe SHELL32.DLL,ShellExec_RunDLL "C:\Users\Public\Libraries\Graphics\AdobeLicensing.exe"" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Graphics /t REG_SZ /d "Rundll32.exe SHELL32.DLL,ShellExec_RunDLL "C:\Users\Public\Libraries\Graphics\AdobeLicensing.exe"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3660

C:\Users\Public\Libraries\Graphics\AdobeLicensing.exe
C:\Users\Public\Libraries\Graphics\AdobeLicensing.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864

C:\Users\Public\Libraries\Graphics\AdobeLicensing.exe
C:\Users\Public\Libraries\Graphics\AdobeLicensing.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeLicensing.exe

Path C:\Users\Public\Libraries\Graphics\AdobeLicensing.exe
Size 397KB
SHA256 4761183bc8bff993a5551916eda73c84bb8f9eadd24c4c19587045bb91609a83
MD5 c751af3a2b5e5085e0cf4a66a09480d9
SHA1 0d451c8ee760d3fdf1233b44b657dc10e0450bb6
SHA512 bd88ea76db942b4fd865ed986be75d6df6a90d10f3600a4c3f330a0d7935b1906b536a2eb2cc0211dd199bf2a37440d0a8febbbe6c6ad9b9027e6e59c9511e01
SSDEEP 12288:n5RmQFpKMFeO7Blp/B8Z7QZLJZpT6672GbziER839l/d6LYE2B38jqLX:Z/l839l/ooEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcef.dll

Path C:\Users\Public\Libraries\Graphics\libcef.dll
Size 190KB
SHA256 966ab1c468e3fc7d8d8b2d73a9ca9a85d352a0db8043c5eab36dd304a5915812
MD5 268d61837aa248c1d49a973612a129ce
SHA1 1da0d7053ace976847cc2c9ff783743195178013
SHA512 ec9015ffb5d7f5b545ce30f91314de961757c1f885ef3a66a7b918418f48cfbe38dcfa9d2ac9c8969469560d50696a55c8a9d5b55f58f675e1248b7328ccbcaa
SSDEEP 3072:GZyxSazBuliXpfiRFc/E4RqaHH+h2hsD1ZeTir6l9ZsyBtPUb:Gn4pKrcZqWH+hGsfeTZL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1352-3-0x0000000000DA0000-0x0000000000DA2000-memory.dmp

Download

memory/1352-4-0x0000000002860000-0x0000000002871000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads