841a98464457d2fceff8a35e6b575b1e5e0681f7232cb3c2b94c698e38960a25

Resubmissions

25-03-2024 21:05

240325-zxdnnahe48 3

25-03-2024 20:59

25-03-2024 20:56

25-03-2024 20:51

25-03-2024 20:45

25-03-2024 20:38

25-03-2024 20:36

Analysis

max time kernel
20s
max time network
18s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prefetch/CTFMON.EXE-795F8130.pf
Size

10KB
MD5

16cca8e728ec0f299a431d43d392081d
SHA1

9ae6349bde9afdc7673a20d946807338dbeac261
SHA256

d57e249ca14c74dcbcb4ad6a69abb8809d69fb16f3c5b78f7c1ce7255d32d08b
SHA512

af8072cc904162c1e13bf7af318f598e8268f1b3a42e63948dcbd716f9c3de7dec60a349398310b49c84ae0af2e4fe1ff963c170d8c16c77920bf08c6353e49b
SSDEEP

192:Abs2Dr+Mm20OvKKVItizdDI9g42YsYbh8oAbkt+4/wIcbPb0O8pPQEDZ:5MIeKKVItg1Qs6h8oAbkZib0O8dQOZ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pf_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pf_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pf_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pf_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pf_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.pf	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.pf\ = "pf_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2600	AcroRd32.exe
2600	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2612	1900	cmd.exe	29
PID 1900 wrote to memory of 2612	1900	cmd.exe	29
PID 1900 wrote to memory of 2612	1900	cmd.exe	29
PID 2612 wrote to memory of 2600	2612	rundll32.exe	30
PID 2612 wrote to memory of 2600	2612	rundll32.exe	30
PID 2612 wrote to memory of 2600	2612	rundll32.exe	30
PID 2612 wrote to memory of 2600	2612	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Prefetch\CTFMON.EXE-795F8130.pf
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prefetch\CTFMON.EXE-795F8130.pf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prefetch\CTFMON.EXE-795F8130.pf"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bfd1a0eaa9b0b49716c8967a0948e21a

SHA1
f8cc39feaa95b08b97b5c3a1bc190cc8a6e79bea

SHA256
c41070dab9d73e941b24a4b32d58ac811beb1f1d99dc616f63d2e031697aa253

SHA512
6d4c438dcc096534dd4c3a53e319cb684d1d391fc352a02adf90a6ff8c9fb8ce6ca868787cffa69d3b94f6f04fce818fba3d889f01b94df88cef2ac5deccc398

Download Submit