fa925b3e76ed9daa56d7dc81d622202a7aa2649f923f97a986d214bc1ccad048

Analysis

max time kernel
126s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cat.Goes.Fishing.v13.11.2019/data.win
Size 30.5MB
Sample240302-2lcnbsae44
SHA256 5f8f4cace5209e04b2e0ab89bd389bca2f8267324451fb1dc9aff2b8afeff670
MD5 f0f83505ddf3809d75ab491f2b973251
SHA1 32399876db595612fd20fe238843687b81d3f664
SHA512 4e4db0dc092224854e096e94adbc8c7c3e85fe777e20afa36b6dd64953f398cb29e730c9fb33228e7cf8e5796ba6f2e7b1d4e027b5b29967dd4878e26f1fada0
SSDEEP 786432:azrw7DXbDhcBQncsCUUcKN+CjcN3EaMjsdXS:F7DXbD5c58Eai
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.win	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.win\ = "win_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\win_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\win_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\win_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\win_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\win_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\win_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2732	rundll32.exe
2456	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2456	AcroRd32.exe
2456	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2732	2200	cmd.exe	29
PID 2200 wrote to memory of 2732	2200	cmd.exe	29
PID 2200 wrote to memory of 2732	2200	cmd.exe	29
PID 2732 wrote to memory of 2456	2732	rundll32.exe	31
PID 2732 wrote to memory of 2456	2732	rundll32.exe	31
PID 2732 wrote to memory of 2456	2732	rundll32.exe	31
PID 2732 wrote to memory of 2456	2732	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\data.win
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\data.win
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\data.win"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 186a9139d0efbde5783c00cf9a8d9f104f125edbfb7c57287eb3ca0897eb46a9
MD5 d28ed2cfbd04922ed061163355274331
SHA1 c2caa6573452fd361b1d36d16185a51f8b46c70e
SHA512 ad7f987116b8c7f3acd72cb765bdbf0b37dd8be5199a93e97667017d87161d9ff07b8263e9c7df291a3d6aa10727b0d0eeb98c7919dfa8f7c151ca15dbe36483
MD5 SHA1 SHA512

Submit Download