Resubmissions

25-03-2024 21:05

240325-zxdnnahe48 3

25-03-2024 20:59

240325-zswcxahd77 3

25-03-2024 20:56

240325-zq3dfahd45 3

25-03-2024 20:51

240325-zm6xfshc96 3

25-03-2024 20:45

240325-zj6ghsca7s 3

25-03-2024 20:38

240325-zezs6shb67 3

25-03-2024 20:36

240325-zdscpshb45 3

Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-03-2024 20:38

General

  • Target

    Prefetch/AESM_SERVICE.EXE-85691CD5.pf

  • Size

    8KB

  • MD5

    3b714e130a2eb5a43b2aea4100fd0ef7

  • SHA1

    9dc76d0ccace1b374651c86b008393e7c4ba359e

  • SHA256

    028b64fd5c6d741b38be316243bc4789b565aaf46023316c085888816f74a907

  • SHA512

    e4f2710c5f455e74dc220a40a180e26b982410bf5cc1d0f4038bea2f731b6089ff910b2de5fec3a49984ef6755aad19da01ccba92b3e450407b1b3ee949de10f

  • SSDEEP

    192:z68oTB/DnoqV7aNOU7tm+kBBGk+enA9p6DBG8qUue9Kmgm:zETB7j2NO0tmck+e46tpqdehp

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Prefetch\AESM_SERVICE.EXE-85691CD5.pf
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2852
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prefetch\AESM_SERVICE.EXE-85691CD5.pf
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prefetch\AESM_SERVICE.EXE-85691CD5.pf"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    011bcae974492721684fff42619b7053

    SHA1

    a1725af3e9d849c97310542616cf60985f915162

    SHA256

    fbca2202c463bc813d3809497e52eeaa8c88faae3d63a531c2c301792ba72aeb

    SHA512

    8a731a7a2657dbcd74895c7847f27d609b8e5062fd6d812b227668a15f16d6ee0f74e0d17856392e1804e6ca8a2480c7ac8aead34a38568b39cd4f614e0b936f