babb6603ef3db2a4394ad8ea40c6373245dad6604bee7481383acd003cf9f70a

Analysis

max time kernel
237s
max time network
281s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

GB1263.gb
Size

128KB
MD5

ae073c63ff7d151dc2dd406830fbbdc2
SHA1

4a8c1dd74b1279c0dc85ac2bebb5db2795cb67b0
SHA256

9ac1f4a299d32ba21cf65f67ab210afeb4c629adbd8e5779f76b6667ca3a0a4a
SHA512

2d566b05e25a3f5d3a16c14145c494c87bc990f4e707b4536d0eda1e9f8c8a406d06289930d66d7588198c6ec0153608d7142267c4dae6bdfe1e97a532c88470
SSDEEP

3072:w/gytigSLdFEVDTG5w1w265DX6hF00AUyLhKYwfbEQ:w/JtwYZ11w265DX6hRA/Gf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\gb_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\gb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\gb_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\gb_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.gb	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.gb\ = "gb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\gb_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\gb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2736	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2736	AcroRd32.exe
2736	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1184	1060	cmd.exe	28
PID 1060 wrote to memory of 1184	1060	cmd.exe	28
PID 1060 wrote to memory of 1184	1060	cmd.exe	28
PID 1184 wrote to memory of 2736	1184	rundll32.exe	29
PID 1184 wrote to memory of 2736	1184	rundll32.exe	29
PID 1184 wrote to memory of 2736	1184	rundll32.exe	29
PID 1184 wrote to memory of 2736	1184	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GB1263.gb
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\GB1263.gb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GB1263.gb"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
619e22cdd83a2ade14eee20465fb080f

SHA1
9441e2bd3e0c268b461b7d439b6fa6701152cfe6

SHA256
b45a79ff544c4402efc0aa72bdfd26b4b623d2a74e385a226198ed17e1828bf0

SHA512
21bba1b4e5ca7e2708082c68de2ad3418c4761031504b57a8a5dd0d7add9908f853be2c481d008a7f1621231658f1fb4863944aabbd0a305a399fd71c6a7b412

Download Submit