dcfe168ca869fc3631de17fe0c36df34a43be0b85a34c06df933ff5b0f5ec21c

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BO2 TU18/fr_patch_loc_mp.ff
Size

108KB
MD5

f4b6da07c8d0956db2324031d68e0fae
SHA1

be48935c765f57aabeb96e3e058a7d6e7906a5bd
SHA256

87c16762c470719868dcc75905b68f27db2d189b05212782673b346a2a3641b8
SHA512

52f59eecacf27e85ac46b62065aea17ed7fb84a3aa2c78100a96771349df42c6ec522d765d77e32540cd93029eaee394a977615ff366f1017a9732a039d4571c
SSDEEP

3072:Op5tW7yr63oiZhTojNlUpvf9cCuLKM2KMF1tPWx:C5UA65Lo8pNueMtMF15Wx

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\ff_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.ff	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.ff\ = "ff_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\ff_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\ff_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\ff_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\ff_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\ff_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2444	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2444	AcroRd32.exe
2444	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2672	1908	cmd.exe	29
PID 1908 wrote to memory of 2672	1908	cmd.exe	29
PID 1908 wrote to memory of 2672	1908	cmd.exe	29
PID 2672 wrote to memory of 2444	2672	rundll32.exe	30
PID 2672 wrote to memory of 2444	2672	rundll32.exe	30
PID 2672 wrote to memory of 2444	2672	rundll32.exe	30
PID 2672 wrote to memory of 2444	2672	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\BO2 TU18\fr_patch_loc_mp.ff"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\BO2 TU18\fr_patch_loc_mp.ff
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BO2 TU18\fr_patch_loc_mp.ff"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
54e5ab422b0b3a5610e11fa2bee64bee

SHA1
f14a6a7205ea1dc32747330ea4df857ad7125529

SHA256
e8bdb702a4a2539d8379998fd5c89623bdebe6bdae6952df71e6a0a1c1cdb3ca

SHA512
c5f33b056afb7f0238dacd210eedc634f4f3bed5accdc07fb75e6a077ec5fba5519a60fed989bbfb1a2c647709aa3692e008d7f7742ff0bf2dc3b247afb74b9a

Download Submit