0d8ea62f062e14bdded875879212a3162fd0c08737ba38332fdce0ef1eebcd83

Analysis

max time kernel
138s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R3Air.2.0.0.Release.64/Adobe AIR/Versions/1.0/Adobe AIR.dll
Size

19.9MB
MD5

4561661d3df1ebcd6823e7592f8cc233
SHA1

94fe04b01d36fbff427d91686cb227ee61aac43b
SHA256

e9fb88df973afeb78c28fb35fa5bba80ea459e00aa3aa054aa839ad3bf4f7023
SHA512

9062af4b89e734569ab7a8497ca6030474964cb026fc2c980d3d8383d6edf144d992ebe4a8ca20b3f88c3c0edd622f3b1898fb2fd5b4b281e930940b8ff00fe6
SSDEEP

196608:A3XhOzQeiK/hSKsJ3gQ5tMBIf3txX7K8qGs/JfD/X6MpTP+i:A3XhOzQE/hSKsJwQ5tMc3z7WGSfHT2i

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2040	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\R3Air.2.0.0.Release.64\Adobe AIR\Versions\1.0\Adobe AIR.dll",#1
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...