a30798880eab8c6158073a38e63d5c014de3976e623e38c29b65dc1e6b0be3ef

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a30798880eab8c6158073a38e63d5c014de3976e623e38c29b65dc1e6b0be3ef.unknown
Size

34KB
MD5

8c29d4c72097d005a88b7aea2d950e35
SHA1

327847bcece765728abb142b482bafdc5442cc58
SHA256

a30798880eab8c6158073a38e63d5c014de3976e623e38c29b65dc1e6b0be3ef
SHA512

d69b93a8ff778d6c136e7391c9a7b50dbda75791106cd1b666f69f6bcaabdd780ed396a63c34b532ea1d196298e163efc7e609dec3e9e28580c24a6739cbb4c5
SSDEEP

384:5aDtSLuFExF5GY92GbLfe50jOP91p/C1UV6WHUN5Rr1:wI5DBi79141UV6WHSp

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\unknown_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\unknown_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.unknown\ = "unknown_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\unknown_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\unknown_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\unknown_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\unknown_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.unknown	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2756	AcroRd32.exe
2756	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2292	2264	cmd.exe	29
PID 2264 wrote to memory of 2292	2264	cmd.exe	29
PID 2264 wrote to memory of 2292	2264	cmd.exe	29
PID 2292 wrote to memory of 2756	2292	rundll32.exe	30
PID 2292 wrote to memory of 2756	2292	rundll32.exe	30
PID 2292 wrote to memory of 2756	2292	rundll32.exe	30
PID 2292 wrote to memory of 2756	2292	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\a30798880eab8c6158073a38e63d5c014de3976e623e38c29b65dc1e6b0be3ef.unknown
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\a30798880eab8c6158073a38e63d5c014de3976e623e38c29b65dc1e6b0be3ef.unknown
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a30798880eab8c6158073a38e63d5c014de3976e623e38c29b65dc1e6b0be3ef.unknown"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9540965cb6fd5104ef03b3d1e08fd619

SHA1
0a57d7a44c4a2cb13dfec55f01bed5316fdae389

SHA256
8a1d0dc08695bc2055fc53dc89eaa5830e328ab647791d3285469c2d84eceb5f

SHA512
9ad9b6c82bf82ce02bc04c77ace6aad0939abb14c131728b89da92a4be3902bb8f10b423e59501a7872d3e21c716b870270f7716a64a0f8349492de298305eb5

Download Submit