0f71d3af9a3af791b378eef2095e741a4829b87c0ec88ac76dea2f1af19f5437

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/04/2024, 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[CD] Mass Effect [L] [RUS ENG] (2008, RPG) (1.00 1.02) [1С] [rutracker-5468771].torrent
Size

35KB
MD5

ef00f075fd14de69328dd918f3c08eee
SHA1

a469ada4863bf1ab2f13cf17e73a4b2473699373
SHA256

0f71d3af9a3af791b378eef2095e741a4829b87c0ec88ac76dea2f1af19f5437
SHA512

ea33ee77b95f0c41cef174aa7547ed8c8e5bae8c514d32e17295766f469b8e6c7c01475b9ff8d5a021be27f6893a48f962f3389510d87af1467172dc983c0a69
SSDEEP

768:zs5clUKg8wHwWtjYkLa3y8dwDpueE1Fpw6PpMBIzPdUJ2QlBVRQ:znlg8/ijnLq4u5PbPgBVRQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\torrent_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\torrent_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\torrent_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\torrent_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\torrent_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.torrent	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.torrent\ = "torrent_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\torrent_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2512	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2512	AcroRd32.exe
2512	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2556	2772	cmd.exe	29
PID 2772 wrote to memory of 2556	2772	cmd.exe	29
PID 2772 wrote to memory of 2556	2772	cmd.exe	29
PID 2556 wrote to memory of 2512	2556	rundll32.exe	30
PID 2556 wrote to memory of 2512	2556	rundll32.exe	30
PID 2556 wrote to memory of 2512	2556	rundll32.exe	30
PID 2556 wrote to memory of 2512	2556	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\[CD] Mass Effect [L] [RUS ENG] (2008, RPG) (1.00 1.02) [1С] [rutracker-5468771].torrent"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\[CD] Mass Effect [L] [RUS ENG] (2008, RPG) (1.00 1.02) [1С] [rutracker-5468771].torrent
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\[CD] Mass Effect [L] [RUS ENG] (2008, RPG) (1.00 1.02) [1С] [rutracker-5468771].torrent"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
99b152d20d30e60cef00e5946677b78e

SHA1
17406c21d9e1920b3c8f3ab6ef73a43d868ca354

SHA256
e81c9c739f7bbf587a6c0debca731ef012c9a45048eee462577a78f4d72c80ce

SHA512
65a14f9eb4c2955018bda304535db96117f61662adc7559a98cec147dca04e4af06c757c8c7ef0fa2001f2e37bc70ae08c1aa7e6d6648f48fdf2abfa049c6296

Download Submit