2468a1afd4808daae3e762ceafa3559b7633a836384358bb652bfae77791ed6f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

renderer/materials/RenderChunk.material.bin
Size

134KB
MD5

b9f6d5cb70a621cbb62bdc4f8482e301
SHA1

018624582b064b01ccf1a169b045d54b7632d3ff
SHA256

7e892631868805cfdb278defa209d7569356bf6c90858ed1a3790594451e1519
SHA512

ad6bfa622ec3823fb40fe880242a16c019a5cc5b2964627c0f83005964fc97863dedaed27985cb0e6dd11f2114f3c6127bb860c55d3fc21a25655b7425a84ead
SSDEEP

3072:nEdF3MzH3L2S372wY3Ee3Bu3/VSJOtt6ry5OF3WorfVbljHPd+v5SHdtBS5mE3+5:yWGB8OycJVfVRlHRM0Zk16i7naCBWmDK

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\bin_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.bin	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\bin_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\bin_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\bin_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\bin_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.bin\ = "bin_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2916	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2916	AcroRd32.exe
2916	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2580	2984	cmd.exe	29
PID 2984 wrote to memory of 2580	2984	cmd.exe	29
PID 2984 wrote to memory of 2580	2984	cmd.exe	29
PID 2580 wrote to memory of 2916	2580	rundll32.exe	30
PID 2580 wrote to memory of 2916	2580	rundll32.exe	30
PID 2580 wrote to memory of 2916	2580	rundll32.exe	30
PID 2580 wrote to memory of 2916	2580	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\renderer\materials\RenderChunk.material.bin
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\renderer\materials\RenderChunk.material.bin
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\renderer\materials\RenderChunk.material.bin"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e1215673930c16fafb860f615c32253d

SHA1
e5170436e0fdb9e7b9ddc52a9f87f2bf8dacdc5c

SHA256
51bb3c40d292140cdfa3ee86e9edb73e9407124e6a1acfb49652b7cb8a4ecbd6

SHA512
c7b19971d3e4364dd393c8a00fe5238a64796b1bc6b35e17543df20593b7d6ff636403f7c984397e8403e0caa562e43cad1d2ad2df90a9b09a0e74bfb5347836

Download Submit