841a98464457d2fceff8a35e6b575b1e5e0681f7232cb3c2b94c698e38960a25

Resubmissions

25/03/2024, 21:05

240325-zxdnnahe48 3

25/03/2024, 20:59

25/03/2024, 20:56

25/03/2024, 20:51

25/03/2024, 20:45

25/03/2024, 20:38

25/03/2024, 20:36

Analysis

max time kernel
18s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prefetch/CTFMON.EXE-795F8130.pf
Size

10KB
MD5

16cca8e728ec0f299a431d43d392081d
SHA1

9ae6349bde9afdc7673a20d946807338dbeac261
SHA256

d57e249ca14c74dcbcb4ad6a69abb8809d69fb16f3c5b78f7c1ce7255d32d08b
SHA512

af8072cc904162c1e13bf7af318f598e8268f1b3a42e63948dcbd716f9c3de7dec60a349398310b49c84ae0af2e4fe1ff963c170d8c16c77920bf08c6353e49b
SSDEEP

192:Abs2Dr+Mm20OvKKVItizdDI9g42YsYbh8oAbkt+4/wIcbPb0O8pPQEDZ:5MIeKKVItg1Qs6h8oAbkZib0O8dQOZ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pf_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.pf	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pf_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pf_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.pf\ = "pf_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pf_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pf_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2980	AcroRd32.exe
2980	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2700	1672	cmd.exe	29
PID 1672 wrote to memory of 2700	1672	cmd.exe	29
PID 1672 wrote to memory of 2700	1672	cmd.exe	29
PID 2700 wrote to memory of 2980	2700	rundll32.exe	30
PID 2700 wrote to memory of 2980	2700	rundll32.exe	30
PID 2700 wrote to memory of 2980	2700	rundll32.exe	30
PID 2700 wrote to memory of 2980	2700	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Prefetch\CTFMON.EXE-795F8130.pf
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prefetch\CTFMON.EXE-795F8130.pf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prefetch\CTFMON.EXE-795F8130.pf"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0080a9dd8b5605fca5c3aff2bc1612b8

SHA1
a207472eefa62251e4a91075c11470ed7b470161

SHA256
0a7b7790ca9c1b4445cef4e6557de9c4ca7297a73d90ce472ac8a40f505e9f83

SHA512
5ceb825a53bdb03c6584c94b9510565e88401b4cf693603bf38b9895bfe97eb48d770bacdd71fd1d23ad7737c448867fadda594f24c10c12e8e53da945502d29

Download Submit