2d9af045c4b486811a5c7247b9cbe9156829f83e439b4aa2997c58ffc3a4f919

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

quest_3-3.usdc
Size

648KB
MD5

f9f3673090ed5a019e52a2e6a652be73
SHA1

8fe85aad94101e73403dd97901f1b39f7711c554
SHA256

5e73e8943155b9ddf4c02a23baa37a5ffb362e4cb19feb2038175e6c8a393c3d
SHA512

420908205e9a5a6fbf73c5105591e4277b5b088e5d028d4a33b94e57dae4ce3755e70e3feadd42ff98ed457e0ac7d0f1050c4d585ff58a04d72634930caa557f
SSDEEP

12288:pJz0sq9AdqjhEjrm1aX5hSoHB9fBNq8npbvnYug8jS/o9eH69ZZHlNJm:oskAojOOxoHB9fzq49+sS/+Z9Zvnm

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\usdc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.usdc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\usdc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.usdc\ = "usdc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\usdc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\usdc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\usdc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\usdc_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2704	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2704	AcroRd32.exe
2704	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2692	2024	cmd.exe	29
PID 2024 wrote to memory of 2692	2024	cmd.exe	29
PID 2024 wrote to memory of 2692	2024	cmd.exe	29
PID 2692 wrote to memory of 2704	2692	rundll32.exe	30
PID 2692 wrote to memory of 2704	2692	rundll32.exe	30
PID 2692 wrote to memory of 2704	2692	rundll32.exe	30
PID 2692 wrote to memory of 2704	2692	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\quest_3-3.usdc
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\quest_3-3.usdc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\quest_3-3.usdc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f0d5a82959859cc25536e9f15a432150

SHA1
1f4c490cc7d27cf4539d1139becc9f63a453a164

SHA256
27173d5f5d1b65df643dfca517134adb94d08884686fe0c5510aaaed1b2a59af

SHA512
1f325a2c4f5210ca69812f66f005ddaa75177e85b9a94accf1c1ba70e06e9e0a490c5fdf797ee985739c34704d102e1fd9db427bf2074986e2e69d5e82f75f8e

Download Submit