dcfe168ca869fc3631de17fe0c36df34a43be0b85a34c06df933ff5b0f5ec21c

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BO2 TU18/fr_patch_loc_zm.ff
Size

49KB
MD5

a2bfac6ca3587543822c9495eaa5a54c
SHA1

f01b3c9ae772b1a0556fb743d88ec0dea4d8cace
SHA256

323037aad1e649c1896042947179bedb1554fe479743b729fe24411a2091a39d
SHA512

98b00db4c95928cb930d931ce628f889e462046057a25b8d20bd4d9d421558c934cbe43c5e5a5b51a7a0956dd2958947c609c98e9927b7bbcebad85a7e66d0a4
SSDEEP

1536:af5gQrHsyYGCZTGjSK4Xe2fzdFMTcFONltD:g5RrMhah43owyl5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\ff_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.ff	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.ff\ = "ff_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\ff_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\ff_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\ff_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\ff_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\ff_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2772	AcroRd32.exe
2772	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2544	2112	cmd.exe	29
PID 2112 wrote to memory of 2544	2112	cmd.exe	29
PID 2112 wrote to memory of 2544	2112	cmd.exe	29
PID 2544 wrote to memory of 2772	2544	rundll32.exe	30
PID 2544 wrote to memory of 2772	2544	rundll32.exe	30
PID 2544 wrote to memory of 2772	2544	rundll32.exe	30
PID 2544 wrote to memory of 2772	2544	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\BO2 TU18\fr_patch_loc_zm.ff"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\BO2 TU18\fr_patch_loc_zm.ff
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BO2 TU18\fr_patch_loc_zm.ff"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2b8864f9cd1ac848801a6569fafd4be6

SHA1
8e971ee459ba8b449d55a4fb19211c0e7daa99ba

SHA256
4bb3dbe95404396f5ffca58234be2f61efea6697b0fa066823a73ad8db0f816e

SHA512
1c3dfc58b03600c5bcc5aecb48ddba50d89ef462f91e5ced5e7242f80668b2c99a476068c807baab7fac8820c21578e926a21a8cba427b4e5698bd931dbddeb8

Download Submit