9123a2e6c0bb2c8aa28ab062628c23cac115499216af87776fe58afcfb852a2f

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 13:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

conf/language_pl.properties
Size

8KB
MD5

37dc1efbd4a4cfcbb17e6e380b285c9b
SHA1

4a0a3443c2d1e77ee92dbd3070f3fd934d30b052
SHA256

36a6f88f591e8afb9a9d6b590446a93cbbfe11f9504047e9379943bc8ab0f57c
SHA512

16f47245da25a62a2ccd4d95bac2e53d1528f3e34e9dd98a23b2f079d6922336c0ac326aa462c9440d1f68e51bd05d43b6dfbd2f9eb49083cc6413bfae607f0f
SSDEEP

192:Qy96U8WlAuOMrYLXWUcOECXbASDGkx2cWYq0M3G1ASIzY:h1Dl5OMrIXWUcOEgbBGkxJWYq0M3M3r

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\properties_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\properties_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\properties_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\properties_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\properties_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.properties\ = "properties_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.properties	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\properties_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2664	AcroRd32.exe
2664	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2760	1740	cmd.exe	29
PID 1740 wrote to memory of 2760	1740	cmd.exe	29
PID 1740 wrote to memory of 2760	1740	cmd.exe	29
PID 2760 wrote to memory of 2664	2760	rundll32.exe	30
PID 2760 wrote to memory of 2664	2760	rundll32.exe	30
PID 2760 wrote to memory of 2664	2760	rundll32.exe	30
PID 2760 wrote to memory of 2664	2760	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\conf\language_pl.properties
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\conf\language_pl.properties
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\conf\language_pl.properties"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e933cbca61bad680589af4fda8e7daab

SHA1
41b697393c495813320532af2abeea8c37abb57e

SHA256
ee00b1c5ebfa572c75340645a035100ce8f83e7e8eb75df535336147a71ec16c

SHA512
1a2cb2dea50958c1b53fe9e27a42f8f3c4564ba1b2fc2c922eb941d33880b57bb97fe48a8dc1ca6fd47dbdfe3295f6011a68eb255bf67721802346238b5a74fe

Download Submit