550321da5b10c472bc719bca2c0df74b240f80eff828079eb5253598fe112ae3

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-03-2024 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SAMP/SAMP.ide
Size

87KB
MD5

9fc8a6769f18d3daceabbbed8632c68e
SHA1

5aef67fcfe871e3828b4686553c9471cf9b72497
SHA256

dd66aa822943526dffe0f80af88547615672c9bb6e9f3fcfde6d6f8b860f93f5
SHA512

17bad517167dd4fb1d70158dfe58015d2fa7760b3c005626d65a6b5280c29b3a92073ba856175b7e4b74cd2dea4e02b7b4ed83487163bbd2b0cbfda32b2190ee
SSDEEP

768:vYnhu2+hTAugR8SQHRcg7B3BOPxsmbPOfypzNEkuCm5UTsJE629iWnKjcGmjpEUB:ABNPxsMjzNwM6HkKEEUmfoqWtn

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\ide_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\ide_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.ide	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.ide\ = "ide_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\ide_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\ide_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\ide_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\ide_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2808	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2808	AcroRd32.exe
2808	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2540	2060	cmd.exe	29
PID 2060 wrote to memory of 2540	2060	cmd.exe	29
PID 2060 wrote to memory of 2540	2060	cmd.exe	29
PID 2540 wrote to memory of 2808	2540	rundll32.exe	30
PID 2540 wrote to memory of 2808	2540	rundll32.exe	30
PID 2540 wrote to memory of 2808	2540	rundll32.exe	30
PID 2540 wrote to memory of 2808	2540	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SAMP\SAMP.ide
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SAMP\SAMP.ide
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SAMP\SAMP.ide"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4fe95598e2e51a1aa343f8a5507c9e28

SHA1
5dee1e08f476b030c9bbb619f75533f34595dc60

SHA256
a65db003634664de98a0d88aa8d050e0a5fc93045ecf67d8f85f18fb74029485

SHA512
8adb68b1a019398a83c1350d853f5534592dc38dbf6e47150de57f7e6c8fadbc798bdd193bf23fafcca342100bd3aeac567fa28c424c3460df906fe728d2da1b

Download Submit