218add6bcb751c57c61eed3354c9ea09f8081301375b5fdb690958f069a5c316

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

hello.apk
Size

194B
MD5

26a16fc25f87a6bfdcc875e429c440b4
SHA1

3afde0b1abe0bd0145694dd41d980b3b222a7441
SHA256

218add6bcb751c57c61eed3354c9ea09f8081301375b5fdb690958f069a5c316
SHA512

242a25a59fb07aeddb61c6decc4d128bf482a40f1f2ecc300ae1f38592a56bc4fb35097ff38c35fe2f647be72738f8b7e4c0af42501723c6215b53ae7b158889

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\apk_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.apk	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\apk_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\apk_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\apk_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\apk_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.apk\ = "apk_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\apk_auto_file\shell\Read	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2580	AcroRd32.exe
2580	AcroRd32.exe
2580	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 3052	3060	cmd.exe	29
PID 3060 wrote to memory of 3052	3060	cmd.exe	29
PID 3060 wrote to memory of 3052	3060	cmd.exe	29
PID 3052 wrote to memory of 2580	3052	rundll32.exe	30
PID 3052 wrote to memory of 2580	3052	rundll32.exe	30
PID 3052 wrote to memory of 2580	3052	rundll32.exe	30
PID 3052 wrote to memory of 2580	3052	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\hello.apk
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\hello.apk
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\hello.apk"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
851648605fee0b75e87bd970e091a070

SHA1
dbb9e125433f5efa6e7d333b2bcbccff3ce1e4ac

SHA256
e0ca559b65812fce73e75d472b773c1e8f7bd48851b4c816f7398d4997215ac9

SHA512
de7cb734b8a889a0eac7a0129cb59b03498b0e1c5dd77731e4cb14e137112502d6efa4b8b5daccd1646ae585bcf42c6c42057df53e701100d5af4c151412ae61

Download Submit