841a98464457d2fceff8a35e6b575b1e5e0681f7232cb3c2b94c698e38960a25

Resubmissions

25/03/2024, 21:05

240325-zxdnnahe48 3

25/03/2024, 20:59

25/03/2024, 20:56

25/03/2024, 20:51

25/03/2024, 20:45

25/03/2024, 20:38

25/03/2024, 20:36

Analysis

max time kernel
18s
max time network
16s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prefetch/SVCHOST.EXE-9F82877C.pf
Size

4KB
MD5

efa80bfbf63467e7997eb13126c4b7c0
SHA1

69e87d47c382e73a4aea164ae18a30fd71b603a5
SHA256

bceffc35472caa85de40de428bcfb2475ca1a22badf9c4f12bab626559ed7f89
SHA512

f7a2a18e6a99275793a21329c1e79ac52ea3d9c32782a149835085f70ee9721f415d8afbc72a3b83023085bf327a4697b5f3f818437126403cc74763ef22437b
SSDEEP

96:mbdmzFvQ3VgDffqv8bHxnarDs6pq4BgUx87pQJAR0gZeIffKJ:oMvawS0blarDs6pqMJ4QvLIU

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pf_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pf_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pf	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pf\ = "pf_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pf_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pf_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pf_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2792	AcroRd32.exe
2792	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2020	2140	cmd.exe	29
PID 2140 wrote to memory of 2020	2140	cmd.exe	29
PID 2140 wrote to memory of 2020	2140	cmd.exe	29
PID 2020 wrote to memory of 2792	2020	rundll32.exe	30
PID 2020 wrote to memory of 2792	2020	rundll32.exe	30
PID 2020 wrote to memory of 2792	2020	rundll32.exe	30
PID 2020 wrote to memory of 2792	2020	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Prefetch\SVCHOST.EXE-9F82877C.pf
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prefetch\SVCHOST.EXE-9F82877C.pf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prefetch\SVCHOST.EXE-9F82877C.pf"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0d805b6341579bf329c7ac0e247d36c1

SHA1
347210599be0ed0d2628a7695df4a4fa9e98decf

SHA256
9c371a8f5f12cb37c58802e1e188349345d44230d67292951881d2c490d3ac34

SHA512
7064ddb2a632ff90e31df5b02250622f918598106781cb6a630f8ae82da822866f8d0dc0757c8829fd002ff073dd0f87c243c3c713d04ce295d6363c8a78e4c9

Download Submit