b21f293030df8c3706f999d014d0e31c7673e07dd45e813e23ce80c606bd74cc

Resubmissions

14/02/2024, 03:14

240214-drczaafe3s6

13/02/2024, 22:25

240213-2b1bmsbg826

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
configs/autosave.cfg
Size 916B
Sample240213-2b1bmsbg82
SHA256 c029522bb51f2eea602e3818be4b495282cc2d8da92421f8bf3ced7dc46098bd
MD5 024ab27dfe02dbcd5357528ac4dbe028
SHA1 2f2b7df7b4557e274d4255cebd65d6d7c125cf95
SHA512 f87d48447e5663be7e63f7f7934d33c795f2201acc753720bbf77af49cf8ab44b6f9618a2a22dd8f08a5d67424ca0c7c566b15b3f172edc34af4b29a23b5d137
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\cfg_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\cfg_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.cfg	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.cfg\ = "cfg_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\cfg_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\cfg_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\cfg_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\cfg_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2800	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2800	AcroRd32.exe
2800	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2036	2264	cmd.exe	29
PID 2264 wrote to memory of 2036	2264	cmd.exe	29
PID 2264 wrote to memory of 2036	2264	cmd.exe	29
PID 2036 wrote to memory of 2800	2036	rundll32.exe	30
PID 2036 wrote to memory of 2800	2036	rundll32.exe	30
PID 2036 wrote to memory of 2800	2036	rundll32.exe	30
PID 2036 wrote to memory of 2800	2036	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\configs\autosave.cfg
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\configs\autosave.cfg
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\configs\autosave.cfg"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 fa81a4f296fd1d427a10a9a64f958dd9ca93c1ad4bc574d908125378c37863b9
MD5 d0375c1548d8a6a567b748d8cc4b8123
SHA1 0de14aac4669552f99f4e6246fd7862ac87fb334
SHA512 bb40c147fb470d1e49811125ebcb1e7a93e4eaaade2fee6495470f3da7a7b2d07e270a118cc1ed3e2f78e72dfbc3e96e0d36a00f1c24337af61b84964966d41b
MD5 SHA1 SHA512

Submit Download