841a98464457d2fceff8a35e6b575b1e5e0681f7232cb3c2b94c698e38960a25

Resubmissions

25/03/2024, 21:05

240325-zxdnnahe48 3

25/03/2024, 20:59

25/03/2024, 20:56

25/03/2024, 20:51

25/03/2024, 20:45

25/03/2024, 20:38

25/03/2024, 20:36

Analysis

max time kernel
18s
max time network
16s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prefetch/AUDIODG.EXE-AB22E9A6.pf
Size

6KB
MD5

07f101a9578a9f9e03f3cc769b18c9e6
SHA1

17cd03dc9eabfec7e40ac1dc6daae033177ac97c
SHA256

4f2a633774994f884b6634ac1b0b77f063d7adbd80675958edd34880439d2fc3
SHA512

8eb0a0d22e715255d524f9f56d8106568135b36d0b6f4c5e3b0c5e51c5900dfcc31f90e2423008933005c8f5c5c1081ece3f25b4ced7f509171694e0b669405b
SSDEEP

192:h6HISI8NVXv0U2DDR4tpfI7JVK6+27tNhYKb6grh/:5o72DDQ27fL+9Zi/

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pf_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pf_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pf\ = "pf_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pf_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pf	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pf_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pf_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2908	AcroRd32.exe
2908	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2544	912	cmd.exe	29
PID 912 wrote to memory of 2544	912	cmd.exe	29
PID 912 wrote to memory of 2544	912	cmd.exe	29
PID 2544 wrote to memory of 2908	2544	rundll32.exe	30
PID 2544 wrote to memory of 2908	2544	rundll32.exe	30
PID 2544 wrote to memory of 2908	2544	rundll32.exe	30
PID 2544 wrote to memory of 2908	2544	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Prefetch\AUDIODG.EXE-AB22E9A6.pf
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prefetch\AUDIODG.EXE-AB22E9A6.pf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prefetch\AUDIODG.EXE-AB22E9A6.pf"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9b54b92428cf6c9d5a1c667737501e93

SHA1
ed01c4cfe4d18ee0572fce9549d95366fbc52f1a

SHA256
f17a65e62d9c60c611c8b7cf43aecd296aa4d524617c6acc00bf4350ce975cab

SHA512
0e22d2c193364b6f725608e32bd86163b775494b95f9caa1a0dbb4dfdf39396c7c5a6474f8d0e0c606a67e1fdfec706bfc9f9e80ba756f30e8827c83aa40cb77

Download Submit