6f9cc7c6fbb7c8349d4eb67b242acbb7ebe23d44423282c8a3ea04386d0a6526

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WFWinXpGf_m-1.0.1.xpgf
Size

514.9MB
MD5

6f7a8ec78eea8fa6c78d3bc88eeab97f
SHA1

adba08e07ee495bc5376480a49f4c831c4aee78b
SHA256

6f9cc7c6fbb7c8349d4eb67b242acbb7ebe23d44423282c8a3ea04386d0a6526
SHA512

5a05e155ea5d81f28d8ee3f0d11ccf488f540e47e47c21d154984990d25a7ee118279807791fe2630ccc7c47a2e7e9b8a7359b1ef24d062bd8c60d846dba88f0
SSDEEP

12582912:f0pexr3FXJPX7N/DtPSp5A1BUcyPY+lz6OxFJW:SexrHrpxQ5MBuluOBW

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\xpgf_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\xpgf_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\xpgf_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\xpgf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\xpgf_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\xpgf_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.xpgf	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.xpgf\ = "xpgf_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1028	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1028	AcroRd32.exe
1028	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2628	2872	cmd.exe	29
PID 2872 wrote to memory of 2628	2872	cmd.exe	29
PID 2872 wrote to memory of 2628	2872	cmd.exe	29
PID 2628 wrote to memory of 1028	2628	rundll32.exe	30
PID 2628 wrote to memory of 1028	2628	rundll32.exe	30
PID 2628 wrote to memory of 1028	2628	rundll32.exe	30
PID 2628 wrote to memory of 1028	2628	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\WFWinXpGf_m-1.0.1.xpgf
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\WFWinXpGf_m-1.0.1.xpgf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WFWinXpGf_m-1.0.1.xpgf"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fa71740f574af8c4b62a204939a0b852

SHA1
cd98d528eb96e6db62f29e9df8495a2389b146e7

SHA256
24f7f26bfb0374a2065c0f2ecbf0c91b2e5fbc8f09925312dc2b33bb5ac56423

SHA512
012ceb9ca600d9f0840bbfe85e648419ac81df2164ce663ac30a6e993b50023920f2e85392b0235357c53865ffd24cd9d01023a8908b412eac3b35a35aff1296

Download Submit