841a98464457d2fceff8a35e6b575b1e5e0681f7232cb3c2b94c698e38960a25

Resubmissions

25-03-2024 21:05

240325-zxdnnahe48 3

25-03-2024 20:59

25-03-2024 20:56

25-03-2024 20:51

25-03-2024 20:45

25-03-2024 20:38

25-03-2024 20:36

Analysis

max time kernel
49s
max time network
50s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prefetch/VC_REDIST.X64.EXE-996BDD8E.pf
Size

26KB
MD5

7367449e1fbb3e854c0a3f7be1c8fa9c
SHA1

3f43be8ee52a01281fc9e678263c62fe4a6434f0
SHA256

b27e77a1714b6d4ab7991ff3e049ef74818683bb78d0bb51f6d1c7b1572537c1
SHA512

c3a8abdfd34ef33a442cd166a69f56293d0db693fca7fb20058b9455ce93d5263e953a1edb3ed58bd42be4df4c733076931fc5427a222e7fbdab2a9996b967e3
SSDEEP

768:A8NLc1Nuvq+6u8GMJ1CmkJryS/yPiTV+h8qlA9Hj2Qtb6NBu:A8NLc1Nuvq+6u8GMJ1CjHjPO+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pf_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pf_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pf_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pf_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pf_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.pf	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.pf\ = "pf_auto_file"	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2376	AcroRd32.exe
2376	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2668	2952	cmd.exe	28
PID 2952 wrote to memory of 2668	2952	cmd.exe	28
PID 2952 wrote to memory of 2668	2952	cmd.exe	28
PID 2668 wrote to memory of 2376	2668	rundll32.exe	32
PID 2668 wrote to memory of 2376	2668	rundll32.exe	32
PID 2668 wrote to memory of 2376	2668	rundll32.exe	32
PID 2668 wrote to memory of 2376	2668	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Prefetch\VC_REDIST.X64.EXE-996BDD8E.pf
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prefetch\VC_REDIST.X64.EXE-996BDD8E.pf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prefetch\VC_REDIST.X64.EXE-996BDD8E.pf"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c1ae5da7cb929489a2e4b0a46da29852

SHA1
4e4e13ae8fe5de1894d541b4ddf2afa5de472a52

SHA256
f4389b0adef6d78b404b8e558a0bdeab5dd3a51014481c3c154260c6ea673d3d

SHA512
70acb896bf695a68cdf4543bb3b41384aa9cf774841d1b8648c2e7aa2799ec7259e30bf564e97f0cb6fa2d37b1a4935112dd92c033f1d01d05c2daba4bb55030

Download Submit