f5128e0f58070f9a6c6f6fb10bb80ccfaeaae755b451731027cc3eaab9a5bb42

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OPP/Assets/AssetBundleBuilder.cs
Size

1KB
MD5

1182bd24cd6dfbacf94e4082f4ae49e6
SHA1

6fdd33e395edadaf596b766fc0803707fc9271c1
SHA256

a369374d685d32908ec2e4330cab7d197b133089d17cc5c5a3e714bc6addfa84
SHA512

42bdc284c51a56ddf9649f85b671a4d377344a57b305cb6fa1e8339dc452317fd6bb12d47ab463d2f085823294053956d3e6cf75d472cf1f8af0bd140f65e8a0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2524	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2524	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2524	AcroRd32.exe
2524	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2524	3052	cmd.exe	29
PID 3052 wrote to memory of 2524	3052	cmd.exe	29
PID 3052 wrote to memory of 2524	3052	cmd.exe	29
PID 3052 wrote to memory of 2524	3052	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\OPP\Assets\AssetBundleBuilder.cs
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\OPP\Assets\AssetBundleBuilder.cs"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
efafabf8a4466ce598d1e720ca7f8624

SHA1
4699df3ecd3eccfa7d37a60c803e0328a05ae4f3

SHA256
eb314bf2197322bdb3c5000a3e781ff2dd6da4b5354e1397fc84c6e03217656c

SHA512
1de95d8f2100f0abb5e0cec7b96575902a876b85c168227771da229e3f89900739aaff3cbbd646717a3347d8a72666d06d9a14668c241ef12d25b2e162c56e94

Download Submit