3b530ace3209771f676e361ebc54dfc5d992d5069db93d416cd4b60745ccc400

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sudsers34/Neoterist/Opslagsbindenes/Oplivelse/smreostens.oxo
Size

5KB
MD5

59b98e0096076c214b314c35cd023764
SHA1

1483583c252be4ff9d3b7bbbb1fa773138fbcf8f
SHA256

0973275a70b8ce3a128ad1528b15d08052ba000b538ff4a4dba0c02d1b0935fd
SHA512

9c3c5ec7565929f7086cb760a8a0646c01aa59c94769b977de6c1cc05070016f0a8db4ca6d06b08c899a59b41e0f787551077e7ddd479fe8f2ba8c5c60f4ac36
SSDEEP

96:a825gt+h2/Df7TJRquQOlZjGs9tFgcNYQ0OKurcDImCR:a/5gt+GfXJYuLZjG4XN9nKuBR

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\oxo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\oxo_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\oxo_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.oxo\ = "oxo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\oxo_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.oxo	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\oxo_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\oxo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2584	AcroRd32.exe
2584	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2544	3040	cmd.exe	28
PID 3040 wrote to memory of 2544	3040	cmd.exe	28
PID 3040 wrote to memory of 2544	3040	cmd.exe	28
PID 2544 wrote to memory of 2584	2544	rundll32.exe	29
PID 2544 wrote to memory of 2584	2544	rundll32.exe	29
PID 2544 wrote to memory of 2584	2544	rundll32.exe	29
PID 2544 wrote to memory of 2584	2544	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Sudsers34\Neoterist\Opslagsbindenes\Oplivelse\smreostens.oxo
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Sudsers34\Neoterist\Opslagsbindenes\Oplivelse\smreostens.oxo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Sudsers34\Neoterist\Opslagsbindenes\Oplivelse\smreostens.oxo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
03315a9bc22f59ba6916e8d0577dc58e

SHA1
340c36292298354f105c641ca9a8656d81e288fb

SHA256
76fd4bcde22c757a06573c84bc529890dbe3378b251b97f38dcc138beb9e220a

SHA512
f0d4d5c5bf20028acd39479d9e693b51be8a66ee3ea7f7745de0efd0bd3a0cff26833899d89bfe1bbb0b267d3558bb011b89481e59d45c130d82f2f8e932575d

Download Submit