798b9999b706eb8240655287d18f6a0b6d1651bba28c33ead722166319d2f6cb

Analysis

max time kernel
117s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TestProjects/Illustration.clip
Size

401KB
MD5

5fa58a1cfe4d012901d566958573a8d6
SHA1

5a9902277022e10edcc958efe726e3a1ecbc2d68
SHA256

ea75d069ed64a735add2133f641c36a2a8543cc9456d6d9a4a8ad014383a9a2f
SHA512

055e1cc893c4490b8f01a0b7d1c5c6dea9ed15b30bbc204458eff4d72bae7cf4ca6696afeccd0d6096d7a9d558e0d712ffc4754a2b7dd0806d84611faf7518ff
SSDEEP

6144:DSHjC/bXMVuexKpJQBntPFvsEnZ2zpSDYj7oo96P:DSHjkY4pJwj7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.clip\ = "clip_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\clip_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\clip_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\clip_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\clip_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.clip	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\clip_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\clip_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2560	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2560	AcroRd32.exe
2560	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2704	3016	cmd.exe	1
PID 3016 wrote to memory of 2704	3016	cmd.exe	1
PID 3016 wrote to memory of 2704	3016	cmd.exe	1
PID 2704 wrote to memory of 2560	2704	rundll32.exe	30
PID 2704 wrote to memory of 2560	2704	rundll32.exe	30
PID 2704 wrote to memory of 2560	2704	rundll32.exe	30
PID 2704 wrote to memory of 2560	2704	rundll32.exe	30

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\TestProjects\Illustration.clip
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TestProjects\Illustration.clip"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2560

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TestProjects\Illustration.clip
1⤵
- Suspicious use of WriteProcessMemory
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6ca1942be10d6385441eb25d57756c30

SHA1
903b7b2e9d0c0bf147fd8df04d4c087e148593e4

SHA256
e21276892074352a65cf997b26fa4688b9742da8e32813e2a772f2a28aae29cc

SHA512
d3ae01d7b8137d73c37a9fb1be6569bd5e0726bbcd51be6d7c02ddd29c009891217811e0109f18f1c809a158e01de7b9402bb02bf024317ac6d59855c5a98105

Download Submit