ecda10d8877d555dbda4a4eba329e146b2be8ac4b7915fb723eaacc9f89d16bd

Resubmissions

13-04-2024 09:19

240413-lapwhsfe7t 3

31-03-2024 01:21

240331-bqsx1abb9w 1

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-04-2024 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecda10d8877d555dbda4a4eba329e146b2be8ac4b7915fb723eaacc9f89d16bd.xz
Size

512B
MD5

35028f4b5c6673d6f2e1a80f02944fb2
SHA1

86fc2c94f8fa3938e3261d0b9eb4836be289f8ae
SHA256

ecda10d8877d555dbda4a4eba329e146b2be8ac4b7915fb723eaacc9f89d16bd
SHA512

b0f4a5259176f7bc2ad23e6c6ed3c0cc575bddfcf87af81b8706dcd8442c70b0b648f5aeff1d9ffc519b839f4db671c0cde9640ecfed30e6bc075233afecb311

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.xz	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\xz_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\xz_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\xz_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.xz\ = "xz_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\xz_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\xz_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\xz_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2708 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2708 AcroRd32.exe
2708 AcroRd32.exe
2708 AcroRd32.exe

pid	process
2708	AcroRd32.exe

pid	process
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2020 wrote to memory of 2168	2020	cmd.exe	rundll32.exe
PID 2020 wrote to memory of 2168	2020	cmd.exe	rundll32.exe
PID 2020 wrote to memory of 2168	2020	cmd.exe	rundll32.exe
PID 2168 wrote to memory of 2708	2168	rundll32.exe	AcroRd32.exe
PID 2168 wrote to memory of 2708	2168	rundll32.exe	AcroRd32.exe
PID 2168 wrote to memory of 2708	2168	rundll32.exe	AcroRd32.exe
PID 2168 wrote to memory of 2708	2168	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ecda10d8877d555dbda4a4eba329e146b2be8ac4b7915fb723eaacc9f89d16bd.xz
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ecda10d8877d555dbda4a4eba329e146b2be8ac4b7915fb723eaacc9f89d16bd.xz
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2168

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ecda10d8877d555dbda4a4eba329e146b2be8ac4b7915fb723eaacc9f89d16bd.xz"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2708

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
bf408245d8e4c66a6199d4ea7b5456f6

SHA1
0b1cf44433cb39dcda991a97a6cd604677bd69a9

SHA256
98810b1d4f2208bbcd9d85394b27070cc15fe8e1ade55f6ef2a77ca6b6ff4334

SHA512
7c2a9c31ed6cd731ee58b9fd5cf5a3384e33c179389f411638536af032f341219f618ae14e94843897062bfb7608fa773c7e03ac7ef027108feed29deb3029ba

Download Submit