f6d439b28fcb5f5ba472e3fa3cc133f8067e34c05b1d358a1a61e75696c1dbad

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cpvp/DIM1/region/r.0.0.mca
Size

1.7MB
MD5

e7bf2341b7eed676be63b7f4b3d7d6e2
SHA1

0aa4274b3cd4117324cc9b115144649ce55fcd35
SHA256

b37e0835f4f9343ffb0a1c331f220d23ed0845d82a67c4a9ceabf1c070f23870
SHA512

30cbdcb3f7016d6e32e79dd4c30b22baa832b18c28ea641ab2afb1a3366735a7b526e8c12cbbcc6b0d1fa74e58cc2754e0593190f1b93f9998cb353325f480e6
SSDEEP

6144:+Nz9dpNPttJ2z8UEeTWvpLyIxNbo2T9Sucx7727A:WDJhLyIxNHpLc572

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\mca_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.mca\ = "mca_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\mca_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\mca_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\mca_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\mca_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.mca	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\mca_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2608	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2608	AcroRd32.exe
2608	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2480	2044	cmd.exe	29
PID 2044 wrote to memory of 2480	2044	cmd.exe	29
PID 2044 wrote to memory of 2480	2044	cmd.exe	29
PID 2480 wrote to memory of 2608	2480	rundll32.exe	30
PID 2480 wrote to memory of 2608	2480	rundll32.exe	30
PID 2480 wrote to memory of 2608	2480	rundll32.exe	30
PID 2480 wrote to memory of 2608	2480	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cpvp\DIM1\region\r.0.0.mca
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cpvp\DIM1\region\r.0.0.mca
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cpvp\DIM1\region\r.0.0.mca"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d48a67e4cc4a9e57fdc2513636da529d

SHA1
a6af56f2595bc282c72da1e4133e97cae79c5f24

SHA256
1c852adb9a5d22b41d147af015049e5b6ba7c2f13c3abd81fb3f2016bad49581

SHA512
5825bc3323e088c814d956648b95ec329d5918ea5672c5cda0c1c93aecc865fa56548d4511f2a947101d665decf93b39b3c7d64903dbb8183cfcbe0e34c74e63

Download Submit