841a98464457d2fceff8a35e6b575b1e5e0681f7232cb3c2b94c698e38960a25

Resubmissions

25/03/2024, 21:05

240325-zxdnnahe48 3

25/03/2024, 20:59

25/03/2024, 20:56

25/03/2024, 20:51

25/03/2024, 20:45

25/03/2024, 20:38

25/03/2024, 20:36

Analysis

max time kernel
18s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prefetch/APPLICATIONFRAMEHOST.EXE-8CE9A1EE.pf
Size

17KB
MD5

cc672becb77f39c92c8b58fa284ef192
SHA1

706543426eb377faee5378b5f3638e429c09a15f
SHA256

8b94df685076d08462a05941cb56b9ecc1355a399d5ad81f3b52370a3186dad8
SHA512

0ab1dc75e665c6573e011900162477c458ea7ba3181db520aafb1b7bbf51d67d6632f8094a4378390e3e274dae8baa3adaec70e7021b0e443d33afd9111ae6f2
SSDEEP

384:/EURF3xfzddT/ShgyHCoT83TcAxn/iHrdE6xQcSduOe:/BJ1bMjioTAcQ/iHe+XSduT

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pf_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pf\ = "pf_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pf_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pf_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pf_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pf	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pf_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2680	AcroRd32.exe
2680	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2180	2868	cmd.exe	29
PID 2868 wrote to memory of 2180	2868	cmd.exe	29
PID 2868 wrote to memory of 2180	2868	cmd.exe	29
PID 2180 wrote to memory of 2680	2180	rundll32.exe	30
PID 2180 wrote to memory of 2680	2180	rundll32.exe	30
PID 2180 wrote to memory of 2680	2180	rundll32.exe	30
PID 2180 wrote to memory of 2680	2180	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Prefetch\APPLICATIONFRAMEHOST.EXE-8CE9A1EE.pf
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prefetch\APPLICATIONFRAMEHOST.EXE-8CE9A1EE.pf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prefetch\APPLICATIONFRAMEHOST.EXE-8CE9A1EE.pf"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e55e6d7979a319e15101074b2b922b55

SHA1
97ca3a193039b7181069826919f374f45e6991eb

SHA256
f1a259e3248fddc225869b0f2430d0f9115836706e0a865ba401b598d30ac003

SHA512
d6c75de8f3cb5cb6e2f5bef21f8f666f8ac0e072f90497b83e42574e2fc0e15e32e0acc54eb4d684ed21fb27422f588b23ae8ec7216eaf816e8ec29bf3ca1b47

Download Submit