fd25f6525440ccb59b3d8bb0a69d673f78f761c21ba456f4149fdf3de4df2d82

Resubmissions

19/04/2024, 11:21

240419-nghrwsac95 3

Analysis

max time kernel
1562s
max time network
1566s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a3df7b827ee74f4d9fed6bcc24726ba/asset.meta
Size

243B
MD5

713e437b7a6741513ac3cc1768fd2931
SHA1

be3f43034017f8d1a6772baea279a372a8a4bd92
SHA256

dafafc7ef17118f4aeaa9cca15b5c6afce01726744877f5f0407b50fe04bf196
SHA512

0f9b9d8f4e999e46774ffaf383e962267ae7d0406aa1b760ea01ffc14442a887d76e99dc33f38b9b22fe0bea9062e42e88846822e92eae211a6d88c99643726e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\meta_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.meta	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\meta_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\meta_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\meta_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\meta_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\meta_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.meta\ = "meta_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2684	AcroRd32.exe
2684	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2696	3004	cmd.exe	29
PID 3004 wrote to memory of 2696	3004	cmd.exe	29
PID 3004 wrote to memory of 2696	3004	cmd.exe	29
PID 2696 wrote to memory of 2684	2696	rundll32.exe	30
PID 2696 wrote to memory of 2684	2696	rundll32.exe	30
PID 2696 wrote to memory of 2684	2696	rundll32.exe	30
PID 2696 wrote to memory of 2684	2696	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\9a3df7b827ee74f4d9fed6bcc24726ba\asset.meta
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\9a3df7b827ee74f4d9fed6bcc24726ba\asset.meta
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9a3df7b827ee74f4d9fed6bcc24726ba\asset.meta"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
95672d838257b95979bd57f683373025

SHA1
76fc6f8699f9122da508bea817df68f8f3a4c81c

SHA256
6effa1a99fad1c1754ad2482a62fd92654cce29d5699a6d8128c59790a3ea968

SHA512
9d85d2f12530b0e95eafaffed69b247da82a637530a73c304b0f94bd843f07782719b354812eac5e1a15b0ac103bdf93650dde66a474a5da5965517cfa2b881e

Download Submit