b3c5e464e43d7db2432f3e28de75bd0eee8fa7a2b7b6fef7134e7115d6681be3

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

INVOICE#BUSAPOMKDS03.vhd
Size

12.0MB
MD5

48474a628c23106feb4587f36b68e5e2
SHA1

d34a9f2003a784774d9401e27a89ecf29817dc9d
SHA256

50c4bbc5e7bda11990739e93a32b18669d6142d0b155d1ee9509722659caa3bf
SHA512

5c5aa7dabd3b174639540e3a444e545eb67e6c256db5ac48efa6e68361d52a589b3124a297446ac08721909eb58a9dc516d3b21d40db4ec9431522456bf95f80
SSDEEP

6144:nlqlGC6H45QtiLJfhB+ZVBGIXcSIcnXy2wg9f5ZezrKWTPd:KLzC7yRqf5szrKQPd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\vhd_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\vhd_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\vhd_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.vhd\ = "vhd_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.vhd	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\vhd_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\vhd_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\vhd_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2452 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2452 AcroRd32.exe
2452 AcroRd32.exe

pid	process
2452	AcroRd32.exe

pid	process
2452	AcroRd32.exe
2452	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2216 wrote to memory of 2844	2216	cmd.exe	rundll32.exe
PID 2216 wrote to memory of 2844	2216	cmd.exe	rundll32.exe
PID 2216 wrote to memory of 2844	2216	cmd.exe	rundll32.exe
PID 2844 wrote to memory of 2452	2844	rundll32.exe	AcroRd32.exe
PID 2844 wrote to memory of 2452	2844	rundll32.exe	AcroRd32.exe
PID 2844 wrote to memory of 2452	2844	rundll32.exe	AcroRd32.exe
PID 2844 wrote to memory of 2452	2844	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\INVOICE#BUSAPOMKDS03.vhd
1⤵
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\INVOICE#BUSAPOMKDS03.vhd
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2844

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\INVOICE#BUSAPOMKDS03.vhd"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2452

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
64f2c6f713611106f9d50f34d81150d5

SHA1
d4069709fc74744c5fc26e50ff546ab8bc8f90b1

SHA256
c3745217600e420d5474e1678ccaf5ab59858b306332c78ebedd3cd7e7d2c1aa

SHA512
6aaec356a89a9d7e99d84c5bfe7f391ea7e6b6332b5c0e7d13a58c93c01ccae4cfaf95881847503eb96ce40a96026e0d0d50713d7bd59eb82a848ea3017da76b

Download Submit