40dca8cc9156a448082670599d1779339738028a616b3c1047178cf0a0baa6e5

Analysis

max time kernel
844s
max time network
846s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc/src/API.rst
Size

62KB
MD5

d7d651221f1a0cd60daf62ffbe48d3d3
SHA1

85bcb6e630944ef3df6790b6177743ba0724167e
SHA256

b01d820cd6e2368930bc607e1fa322dc1e1ce75c0be9342a90f332c23b05826d
SHA512

f317fedf3b8d32384ccd72db6b45284b6cc2397abdb2b8c46834747aa297c364b5e1c2c3266f50c9dc3560f06ba934dcd4f73e88236b7ee2b7147f1c201e37e8
SSDEEP

1536:WBwVk0dwubO84f3MqXvtcbZ+le6gL3cNOXUZc:stubOrMq/tcbZ+le6+3gRc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\rst_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.rst	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\rst_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\rst_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\rst_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.rst\ = "rst_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\rst_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\rst_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2556	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2556	AcroRd32.exe
2556	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2588	3056	cmd.exe	29
PID 3056 wrote to memory of 2588	3056	cmd.exe	29
PID 3056 wrote to memory of 2588	3056	cmd.exe	29
PID 2588 wrote to memory of 2556	2588	rundll32.exe	30
PID 2588 wrote to memory of 2556	2588	rundll32.exe	30
PID 2588 wrote to memory of 2556	2588	rundll32.exe	30
PID 2588 wrote to memory of 2556	2588	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\doc\src\API.rst
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\doc\src\API.rst
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\doc\src\API.rst"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b2034cea3c25aa47240677cf3ecf45ee

SHA1
bd316f0593ab9788933878065f043805e0c595ff

SHA256
87d5297d9bf9cc9a3bc8b86289f757c2226bd433258daa0edb32b95ad074bc64

SHA512
afb2d3c2f4e973f3000c1ea9a91281684e473878c277e3415b6ca7fd7feb8d7b019b2bf0e1d22d05f07bbc436cf20c936e7bbfb543a944f273e99793a3be2670

Download Submit