f6d439b28fcb5f5ba472e3fa3cc133f8067e34c05b1d358a1a61e75696c1dbad

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cpvp/DIM1/region/r.-1.0.mca
Size

1.6MB
MD5

af67f85cb7c6bfb8a3e6f8482c7959fb
SHA1

f1faf6a7bec717c3ffd85545f26c7c9bfa583a00
SHA256

7de3d0eb90020d2a9d2a8fc14ade4351ebacb29ec6dd6d8f58deea578c0a2258
SHA512

206c0011bb35e5327716f6019a03835992c38a8765ca019490f14f2698bfd0c3b8dd87f599b19c37af3a5b64812ea3900060d986db36d3301d5fd809bb82aa3f
SSDEEP

3072:tQgMSoZRCwLd8hsRIjdiRXjgWTGtE2iztR7anIIX+W7jJj8jwT:nouwL+6RUdihMVixpan+W7toET

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\mca_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\mca_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\mca_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.mca	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.mca\ = "mca_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\mca_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\mca_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\mca_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2652	AcroRd32.exe
2652	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2676	2368	cmd.exe	29
PID 2368 wrote to memory of 2676	2368	cmd.exe	29
PID 2368 wrote to memory of 2676	2368	cmd.exe	29
PID 2676 wrote to memory of 2652	2676	rundll32.exe	30
PID 2676 wrote to memory of 2652	2676	rundll32.exe	30
PID 2676 wrote to memory of 2652	2676	rundll32.exe	30
PID 2676 wrote to memory of 2652	2676	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cpvp\DIM1\region\r.-1.0.mca
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cpvp\DIM1\region\r.-1.0.mca
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cpvp\DIM1\region\r.-1.0.mca"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a94e970a0928384d30e6f2539bb7cd70

SHA1
37190c05d6c1776559e549af0559ed9df60f9674

SHA256
d0840c0b16f86c3baa57a9ee0e88ff4572a8153f8a2c45f0ea0151c824b0a286

SHA512
ad6cfce45e8eb9102eb8c1ead6a17add09a88f4360e2e72ba6ac2821d47e382cdef509a61cbbf863d993219b9a595a4c5d4ff3afd92c576724f1d2ea33a7460c

Download Submit