841a98464457d2fceff8a35e6b575b1e5e0681f7232cb3c2b94c698e38960a25

Resubmissions

25/03/2024, 21:05

240325-zxdnnahe48 3

25/03/2024, 20:59

25/03/2024, 20:56

25/03/2024, 20:51

25/03/2024, 20:45

25/03/2024, 20:38

25/03/2024, 20:36

Analysis

max time kernel
18s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prefetch/WIDGETS.EXE-72981730.pf
Size

8KB
MD5

32ff8455471b3a99a4849d67a4fb2977
SHA1

6569716f64ca7033142e30b16855297fe5124fc2
SHA256

d78d25b14d68ba0214b3ed861626e34807260139fe0ba14208515fb721ff9491
SHA512

ec1516240edc27a5b3174d6fabd82c290848fd9652c5bf0bef895bda3e329f4508c0abac5d64d20eb98287ce2015d52019aaa73884545e9ad3c9ceee193a1397
SSDEEP

192:Gl356722hrfaq/b8sKbsRJzcjQ6GRMfKnpkV+Bhlw7t2LxQ57RtJvQsg:GlJK22hrfFMjJG2OkUvlDV2XVQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pf_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pf_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pf\ = "pf_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pf_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pf	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pf_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pf_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2608	AcroRd32.exe
2608	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2560	2324	cmd.exe	29
PID 2324 wrote to memory of 2560	2324	cmd.exe	29
PID 2324 wrote to memory of 2560	2324	cmd.exe	29
PID 2560 wrote to memory of 2608	2560	rundll32.exe	30
PID 2560 wrote to memory of 2608	2560	rundll32.exe	30
PID 2560 wrote to memory of 2608	2560	rundll32.exe	30
PID 2560 wrote to memory of 2608	2560	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Prefetch\WIDGETS.EXE-72981730.pf
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prefetch\WIDGETS.EXE-72981730.pf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prefetch\WIDGETS.EXE-72981730.pf"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
154042f5621009275a2d5ec8af1bd69d

SHA1
1b2c1a69a4f35bc590e860f762456c92461c0200

SHA256
5fe73c92d880e7efdc53f42768842ad461d2c7656a375b90206b4c358a9283ca

SHA512
e685e75928f565813f89499d1e0856a893dcece54a069696cf4616385e0f1fb117c9c412308a9388db4c684acf2c3759728aebe2087e2fb107ee67e52747f483

Download Submit