51243079995f79a55cb37c432a3ba9e38689e78a215f109b409bc19b4bb7be8f

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payload/Apollo.app/BrightnessThresholdTableViewCell.nib
Size

4KB
MD5

d4db16145ac1174f775973cd550f3117
SHA1

989f175b5deff424348a7feade2af0490599fca4
SHA256

c87f6b1432124622d203faca1716849aa6670d4a0efb1a25b4cc16b19e72847d
SHA512

f00da1939ff9611e2863407985751a838f67cf063e4c0d53ad2d8535672550aeadcc1d508a7e5892eddd7ab3ee2560aa93cdd7eec3dc7d630ea562f81683bb12
SSDEEP

96:jXAYPE4sJiF5lxWGb1gqVrAMho8Ggnum9bLMA5Hng1Dm7ln:rAOE4UilxWo1gqFToWxg1Dm7ln

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\nib_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\nib_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\nib_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\nib_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.nib	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.nib\ = "nib_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\nib_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\nib_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2656	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2656	AcroRd32.exe
2656	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1640	1992	cmd.exe	29
PID 1992 wrote to memory of 1640	1992	cmd.exe	29
PID 1992 wrote to memory of 1640	1992	cmd.exe	29
PID 1640 wrote to memory of 2656	1640	rundll32.exe	30
PID 1640 wrote to memory of 2656	1640	rundll32.exe	30
PID 1640 wrote to memory of 2656	1640	rundll32.exe	30
PID 1640 wrote to memory of 2656	1640	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Payload\Apollo.app\BrightnessThresholdTableViewCell.nib
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Payload\Apollo.app\BrightnessThresholdTableViewCell.nib
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Payload\Apollo.app\BrightnessThresholdTableViewCell.nib"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1e439e1510359aa13314c6c7d22afc75

SHA1
0dff6e51e214afadbfb1944230544900e57a643e

SHA256
bc54db46c7b450be0210d8129b3a6dc9e4b5da8738fb4e76569c6c98611024e1

SHA512
c1e3726ebd8ec4b97375660257ea865c0f53b5ec02d9ed14b926f973db757f1998a13966826ca55ae1ec3d3c6478ef06407c790d04485b9518203e217d9523ff

Download Submit