841a98464457d2fceff8a35e6b575b1e5e0681f7232cb3c2b94c698e38960a25

Resubmissions

25/03/2024, 21:05

240325-zxdnnahe48 3

25/03/2024, 20:59

25/03/2024, 20:56

25/03/2024, 20:51

25/03/2024, 20:45

25/03/2024, 20:38

25/03/2024, 20:36

Analysis

max time kernel
18s
max time network
16s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prefetch/WINDOWSTERMINAL.EXE-8DE4DF02.pf
Size

37KB
MD5

086626d45e38aa32233a2256740276d9
SHA1

b39e5e68c98f755cd6973b5e2d51bf3ce10cfafe
SHA256

e104c1f775aefeaee572554c2e3ec1aef9bd08278264f58272b0b4027c17c4b3
SHA512

fa8c00da80b7a390814c818dcf615034c92b785f9e06fcffe9f22b0fbbafd9b93bee373fbe8694e7fe888fe84802f076484d34b5cc9dec83440a612365fab617
SSDEEP

768:boWoW48rUe9YPlL/ftbqZHK/eAxSojRCr1rCut7rxd+rpiB3t:MWo38rUeyPtftWZHDAxhSC63t

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pf_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pf	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pf\ = "pf_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pf_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pf_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pf_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pf_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2520	AcroRd32.exe
2520	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2060	2464	cmd.exe	29
PID 2464 wrote to memory of 2060	2464	cmd.exe	29
PID 2464 wrote to memory of 2060	2464	cmd.exe	29
PID 2060 wrote to memory of 2520	2060	rundll32.exe	30
PID 2060 wrote to memory of 2520	2060	rundll32.exe	30
PID 2060 wrote to memory of 2520	2060	rundll32.exe	30
PID 2060 wrote to memory of 2520	2060	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Prefetch\WINDOWSTERMINAL.EXE-8DE4DF02.pf
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prefetch\WINDOWSTERMINAL.EXE-8DE4DF02.pf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prefetch\WINDOWSTERMINAL.EXE-8DE4DF02.pf"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3ff536ad4f9ec9bd7f467f6a9aa6036a

SHA1
c3eaedc052b6226ef5c2eb1233ca6e4f4ef53042

SHA256
ccfd011815c3a3c7451f1bb94f5c48224a23cf9eeefe210b9f6f656e4e9fd022

SHA512
64467884b6787a54bf7b27e3401b3f9fbcfbdafef2d3fa0bc23102c0e02587eeae82f286b4c8b5288f2ea68c7533a6e2673930309ef722ca912a5a89f81ada29

Download Submit