841a98464457d2fceff8a35e6b575b1e5e0681f7232cb3c2b94c698e38960a25

Resubmissions

25/03/2024, 21:05

240325-zxdnnahe48 3

25/03/2024, 20:59

25/03/2024, 20:56

25/03/2024, 20:51

25/03/2024, 20:45

25/03/2024, 20:38

25/03/2024, 20:36

Analysis

max time kernel
18s
max time network
16s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prefetch/SVCHOST.EXE-B0BE7DB7.pf
Size

12KB
MD5

761a9c6028b23dec5e9d9b6f73fcad3e
SHA1

7a376e029cffb96ab8487cc7ee24401d091223be
SHA256

557f84e7368bc05376d1c2546ef77909234400d10b3e356763a5a288aeac8b45
SHA512

5ee66c3f3c73d97c557a1e0caf00514fe92047ed36adf3e079e9666c1f6fb1f5c4d04268e32cb53f84a63442308ad28e6344d7f47e5f19a251eb6ac2f14b179f
SSDEEP

384:1vTDyw3DdybczbN+lWL6uWejWTxobcuThzA3jpVQKBZ:1L2mRdN+lfurj8WzqQkZ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pf_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pf	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pf\ = "pf_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pf_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pf_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pf_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pf_auto_file	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2640	AcroRd32.exe
2640	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2536	2868	cmd.exe	29
PID 2868 wrote to memory of 2536	2868	cmd.exe	29
PID 2868 wrote to memory of 2536	2868	cmd.exe	29
PID 2536 wrote to memory of 2640	2536	rundll32.exe	30
PID 2536 wrote to memory of 2640	2536	rundll32.exe	30
PID 2536 wrote to memory of 2640	2536	rundll32.exe	30
PID 2536 wrote to memory of 2640	2536	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Prefetch\SVCHOST.EXE-B0BE7DB7.pf
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prefetch\SVCHOST.EXE-B0BE7DB7.pf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prefetch\SVCHOST.EXE-B0BE7DB7.pf"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ca6faa74b8052229953c631f21f17bc1

SHA1
8ccf158efac4be386a1a63901621c4a919f1d099

SHA256
5640bee8b85850b5043696135c987b43e4d7fad62210731b44be7ece8fca15f4

SHA512
53481df0848822a2a3560adfc21f6d6a3701848662e560f5005be493e93aaf37f34b238059af4db58d0f6433d92cbf3e8dfcf78d2ed823e96ef1edaf7744bebf

Download Submit