841a98464457d2fceff8a35e6b575b1e5e0681f7232cb3c2b94c698e38960a25

Resubmissions

25/03/2024, 21:05

240325-zxdnnahe48 3

25/03/2024, 20:59

25/03/2024, 20:56

25/03/2024, 20:51

25/03/2024, 20:45

25/03/2024, 20:38

25/03/2024, 20:36

Analysis

max time kernel
18s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prefetch/SVCHOST.EXE-BAF02086.pf
Size

4KB
MD5

f32bc74db0bd5714ca16118b1d72ae34
SHA1

37fb6f5e3c73af8ec05506f815879a6239d77ae4
SHA256

fa6956b37b9cd85547a322ff8505d72b8e6f1609c2b55f830480b8bf63ae44bc
SHA512

a1593c521b9ce4d732d3f6a135a8f927d3281dd56d94353c149831599bcb86db6323fabdeab8e992ca8545b0da5e8427f92190cd4ce00a6e93b5b7c9e528cfa8
SSDEEP

96:q05cAqlssduourp72vuYftkvY9D4s7Iad5c030/5/hxFHLv5gabqxDFAQ:q0cAquzjytkvCksX40k/5/hxFNtbqxDJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pf_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pf_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pf\ = "pf_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pf_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pf_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pf_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pf	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2520	AcroRd32.exe
2520	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2604	1644	cmd.exe	29
PID 1644 wrote to memory of 2604	1644	cmd.exe	29
PID 1644 wrote to memory of 2604	1644	cmd.exe	29
PID 2604 wrote to memory of 2520	2604	rundll32.exe	30
PID 2604 wrote to memory of 2520	2604	rundll32.exe	30
PID 2604 wrote to memory of 2520	2604	rundll32.exe	30
PID 2604 wrote to memory of 2520	2604	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Prefetch\SVCHOST.EXE-BAF02086.pf
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prefetch\SVCHOST.EXE-BAF02086.pf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prefetch\SVCHOST.EXE-BAF02086.pf"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f00ff99ed160f57a5c98aabdc2ebc8bd

SHA1
ea49318ba6a7013b31021ee2aa55b089ba804909

SHA256
62a3bc6ed9c1e3536ecedf407924282ab706efa20b9a656055f5e5c54fff4635

SHA512
c01e4beda60536b877f6f9a6e2c331fc0af8492797a1f219db5d8ea0d44c4c95d40015fcad55303722b0a2b655252fe91e54cd9e1321cbd2f2f69a12b97b79c3

Download Submit