Analysis
-
max time kernel
1566s -
max time network
1569s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
08-02-2024 20:50
Behavioral task
behavioral1
Sample
ACFrOgA_MEIH1PFAhw6h0-KUrRuvCrBIMRsTxF5OzEK_ruIi3ccyoRlt3Rt8ApiSDryTJve3-6y0IUIp1WqxP1T9uyz0OvZxGehT.pdf
Resource
win7-20231215-en
4 signatures
1800 seconds
General
-
Target
ACFrOgA_MEIH1PFAhw6h0-KUrRuvCrBIMRsTxF5OzEK_ruIi3ccyoRlt3Rt8ApiSDryTJve3-6y0IUIp1WqxP1T9uyz0OvZxGehT.pdf
-
Size
93KB
-
MD5
db86f7dbc8f8e480027b972c010c7f1a
-
SHA1
defe37e75c1463ef4acda633163bd07d3b05856e
-
SHA256
42896c302d2064e8e8ee73171b002879428cf88747c15602452f9fd5d1b0b58b
-
SHA512
c40b6dc0791e249cdd2f2718baf27a20d907024d67131cd20daa8cedf4bad1da9e883562952bf4ab39afc3c4d05c478954ae1f07208591fe58cc42b33e20f759
-
SSDEEP
1536:2Ofi0Tv8XdIUoh9xNJVS5bqZ6y9z9qa7O2VQTb/Z7Rj:ykCoxNJgqYs0aq2VGVj
Score
1/10
Malware Config
Signatures
-
Modifies registry class 20 IoCs
Processes:
splwow64.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_Classes\Local Settings splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff splwow64.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
splwow64.exepid process 2172 splwow64.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exesplwow64.exepid process 2612 AcroRd32.exe 2612 AcroRd32.exe 2612 AcroRd32.exe 2612 AcroRd32.exe 2612 AcroRd32.exe 2172 splwow64.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
AcroRd32.exedescription pid process target process PID 2612 wrote to memory of 2172 2612 AcroRd32.exe splwow64.exe PID 2612 wrote to memory of 2172 2612 AcroRd32.exe splwow64.exe PID 2612 wrote to memory of 2172 2612 AcroRd32.exe splwow64.exe PID 2612 wrote to memory of 2172 2612 AcroRd32.exe splwow64.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ACFrOgA_MEIH1PFAhw6h0-KUrRuvCrBIMRsTxF5OzEK_ruIi3ccyoRlt3Rt8ApiSDryTJve3-6y0IUIp1WqxP1T9uyz0OvZxGehT.pdf"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2172