841a98464457d2fceff8a35e6b575b1e5e0681f7232cb3c2b94c698e38960a25

Resubmissions

25/03/2024, 21:05

240325-zxdnnahe48 3

25/03/2024, 20:59

25/03/2024, 20:56

25/03/2024, 20:51

25/03/2024, 20:45

25/03/2024, 20:38

25/03/2024, 20:36

Analysis

max time kernel
30s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prefetch/WINDOWSPACKAGEMANAGERSERVER.E-830EE13F.pf
Size

18KB
MD5

d14d6a7b9c1d0bce6c35fbc70e8d2dbf
SHA1

ff6b767cbaf916f28b611524aba4b39fce6536e6
SHA256

9ca9ef414f5aed4b9f66f12a59b6844805c0eb2519d526879f0322222d1c75b7
SHA512

6ea4b0181515cca46a9d1c40391421ae164e73e813f534786b2ac84d2b96f2c43bf7a8085a43175ee482abc3bea59d2c26b8a6af6de7f4b5cd5fc7efaefb9744
SSDEEP

384:6/8CoOYNJsYd00IlDp0foX/ykv0rmdT+M2F6lB4/oEUcT6E6:63Ufd0ZDp0Af8mTl2MlB4gmT6E6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pf\ = "pf_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pf_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pf_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pf_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pf	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pf_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pf_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2688	AcroRd32.exe
2688	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2684	2484	cmd.exe	29
PID 2484 wrote to memory of 2684	2484	cmd.exe	29
PID 2484 wrote to memory of 2684	2484	cmd.exe	29
PID 2684 wrote to memory of 2688	2684	rundll32.exe	30
PID 2684 wrote to memory of 2688	2684	rundll32.exe	30
PID 2684 wrote to memory of 2688	2684	rundll32.exe	30
PID 2684 wrote to memory of 2688	2684	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Prefetch\WINDOWSPACKAGEMANAGERSERVER.E-830EE13F.pf
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prefetch\WINDOWSPACKAGEMANAGERSERVER.E-830EE13F.pf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prefetch\WINDOWSPACKAGEMANAGERSERVER.E-830EE13F.pf"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3d17da236891ebf98c19c8c2f61c6769

SHA1
76dee679af1a51e5f8c7f6a3ec774aaf96c24f34

SHA256
3039c4371d0cae50929caa6235f8c8fa60c43cc6b5baa20bc528a72d509b07e0

SHA512
2e8fec805e34b2a53e106a0ee659217babff9ae4b3d396232da49b713d4082dc17f970a7ee8fc4aba500a6a190a25d6d1ad5727dd0efc1299b4a101413587d2a

Download Submit