babb6603ef3db2a4394ad8ea40c6373245dad6604bee7481383acd003cf9f70a

Analysis

max time kernel
130s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Contra (J).gb
Size

128KB
MD5

2cc322a27530f6aaa09a35b2f14aebd5
SHA1

c8b34b5aba3d448e357b59cdf106ee9b134713db
SHA256

8e765a4e381462a29632b7a3c5421080be3e8445e5913d7e904a8e80d688ca81
SHA512

7842221604dc4bca07b3f91e960f8139e7592a3bad9a6abff5cfdd16ca98fa9f0be63d6526af8f2515007fb9ce6187a8b80d4d221da0e1018b9f1c21dcc1ffab
SSDEEP

3072:iwUT/0b6vbu1AvU6Iv68mBdWRaic5xrLWrK/RNYKt:NUDq8UDLiHrarK/Rf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\gb_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\gb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\gb_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\gb_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\gb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\gb_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.gb	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.gb\ = "gb_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2224	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2224	AcroRd32.exe
2224	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2628	2984	cmd.exe	28
PID 2984 wrote to memory of 2628	2984	cmd.exe	28
PID 2984 wrote to memory of 2628	2984	cmd.exe	28
PID 2628 wrote to memory of 2224	2628	rundll32.exe	29
PID 2628 wrote to memory of 2224	2628	rundll32.exe	29
PID 2628 wrote to memory of 2224	2628	rundll32.exe	29
PID 2628 wrote to memory of 2224	2628	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Contra (J).gb"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Contra (J).gb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Contra (J).gb"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0748f6b6736ad75c68ff17abfcc761c6

SHA1
994d1e6d2d2d6cf7b1fd31eba11e305288ece537

SHA256
acc11ca4b189788a24bc49b3ea4952ee4ecb0dfade85b05f4cf0fefd00b63a17

SHA512
483db0ee9913c0d31f711927594ef54a3a18d54d61f7d621fe6817b9557ab9532364936de35d7bc5236de33fb9dae5b722d68bce88ba190806a99909a2a559ba

Download Submit