841a98464457d2fceff8a35e6b575b1e5e0681f7232cb3c2b94c698e38960a25

Resubmissions

25/03/2024, 21:05

240325-zxdnnahe48 3

25/03/2024, 20:59

25/03/2024, 20:56

25/03/2024, 20:51

25/03/2024, 20:45

25/03/2024, 20:38

25/03/2024, 20:36

Analysis

max time kernel
18s
max time network
19s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prefetch/ADB-SETUP-1.4.3.EXE-A5343734.pf
Size

21KB
MD5

6fd09160da05c759840de95bee69af21
SHA1

0359b0e23b70889d61a923915aa3658a5cff574c
SHA256

fea6106bd50519d3ff36c5e6c7bcef8518300d4be018b5d4dadaf197b98fa678
SHA512

989948f76df354a222d636269ff08ab93b4385ba9259dac72202969200da7eae082f6b6926c1cbed5312ded7a609cb3799ecd281b540acc76807c059eb848d62
SSDEEP

384:1AkCq9pQJpXTAVG035zaFg0uMXbrAgccOC8v9SLoNc6DO2q3DbxOUkd98is/ugPN:uqe5uppWlVPccCBN1icHOpx/tM0ysb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pf_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\.pf\ = "pf_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pf_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pf_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pf_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pf_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\.pf	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2440	AcroRd32.exe
2440	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2664	2212	cmd.exe	29
PID 2212 wrote to memory of 2664	2212	cmd.exe	29
PID 2212 wrote to memory of 2664	2212	cmd.exe	29
PID 2664 wrote to memory of 2440	2664	rundll32.exe	30
PID 2664 wrote to memory of 2440	2664	rundll32.exe	30
PID 2664 wrote to memory of 2440	2664	rundll32.exe	30
PID 2664 wrote to memory of 2440	2664	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Prefetch\ADB-SETUP-1.4.3.EXE-A5343734.pf
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prefetch\ADB-SETUP-1.4.3.EXE-A5343734.pf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prefetch\ADB-SETUP-1.4.3.EXE-A5343734.pf"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fbbc213290c3b02471f822cef9eb6e0d

SHA1
f1601515b9d73f7cf11dc5308711dfe42a1f796e

SHA256
8a948be814a97714bdef23db47796788cb8eece7298d45465ca4e69e1aba67bd

SHA512
138c711990ebcb2845774e83e34f047f5e98b6c55299b53f8897688896f44acff09002771bf2ef335b83dca775af8e0afc2cb558e21fd308a72e646ecf69bb7c

Download Submit