d3e26c7296830666e8d5758afc850c5b596ceb3e2c1ebbb01d5dc22ff58ff5fa

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DreamMail4/Language/Resource.gb
Size 202KB
Sample240228-xfbfvsbc98
SHA256 ae781ad62f512407c25c37aebadf058c4f754e869b5237276170cad910d91007
MD5 22be82df4a0527397acc9134ab34644c
SHA1 17539acbce318cf12c4370db52b9988ec1837923
SHA512 1455061b271a1de7acb47e5eee2525bbf8272f89e944320e92fc6acc9453314744ba371fbd324a6a5a4ccb268f2a734b6ada8a7cce68d574e4e2ef3ddfa6f6e0
SSDEEP 3072:AWd95zU0PTzGt9sz0l3HlvX1ObNvszqn/LGGT33FlmRWEUBy8yKgWq:Vd95zNzuszuHlxELGGr7mRa2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.gb	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\gb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\gb_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.gb\ = "gb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\gb_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\gb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\gb_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\gb_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2032	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2032	AcroRd32.exe
2032	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2836	1152	cmd.exe	29
PID 1152 wrote to memory of 2836	1152	cmd.exe	29
PID 1152 wrote to memory of 2836	1152	cmd.exe	29
PID 2836 wrote to memory of 2032	2836	rundll32.exe	30
PID 2836 wrote to memory of 2032	2836	rundll32.exe	30
PID 2836 wrote to memory of 2032	2836	rundll32.exe	30
PID 2836 wrote to memory of 2032	2836	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DreamMail4\Language\Resource.gb
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\DreamMail4\Language\Resource.gb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DreamMail4\Language\Resource.gb"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 156123f92c63a3d820bcb0ce04716dd469d8d6d07e36c3e0e631992595b71711
MD5 1d1a590d0310e141ef1554f5d17d4fbf
SHA1 126b1dec61665c4dfa8ded475e4b893043d1cfd1
SHA512 7b37ff4368e731360d02ec55b3fbb8b732a673724536c5068c516f025f1a87fda9e1e58e287f0bcf4304f369591250ea86585195feb2b2f0065238f62c7dfa9c
MD5 SHA1 SHA512

Submit Download