d16dddc1e9ad69c5ef67afd93eb801c74ca5b95ec8b46741786c8c8ec47b1b1d

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.avd
Size

401KB
MD5

5ce1bb147548e1424ee4794a03ffb252
SHA1

a47a088e3fbdf7c3885e7f4b30af24f51f495e64
SHA256

6a20b1d7772edda460ff20333983eee22df3c6090c0128027e44692b623c6b14
SHA512

3f62a70074a238b4aa8a3f980ffa88414e6aa4cea2cbad4646a3581e99827c0156a1dc45232efe7f0642745d5ce1204c5c5569694788cce0cb2f6fdac24cfdc7
SSDEEP

12288:DBdq3/2agl3HgBzXOvOacnFp0wNl4MQpM1OeKAM0:TkuZyXOvyowUOOeLM0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\avd_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\avd_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\avd_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\avd_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.avd	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.avd\ = "avd_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\avd_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\avd_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2808 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2808 AcroRd32.exe
2808 AcroRd32.exe

pid	process
2808	AcroRd32.exe

pid	process
2808	AcroRd32.exe
2808	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 3000 wrote to memory of 2552	3000	cmd.exe	rundll32.exe
PID 3000 wrote to memory of 2552	3000	cmd.exe	rundll32.exe
PID 3000 wrote to memory of 2552	3000	cmd.exe	rundll32.exe
PID 2552 wrote to memory of 2808	2552	rundll32.exe	AcroRd32.exe
PID 2552 wrote to memory of 2808	2552	rundll32.exe	AcroRd32.exe
PID 2552 wrote to memory of 2808	2552	rundll32.exe	AcroRd32.exe
PID 2552 wrote to memory of 2808	2552	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\base.avd
1⤵
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\base.avd
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\base.avd"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2808

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
7d04c1714f624efcb3e1442c1bd1563c

SHA1
491ca141f258ba826b9b418f8697e03d422d40ab

SHA256
05779d0feb9448d3268d808585e51d0f4d487f4a944a3a88011ea2a1e7f33f85

SHA512
8fddb8ac50433c6b19199d2a7de147b713486369cf0d56c9a40483c3959be4b0d320794b979d60b6a91c506174366a60a97d9d34e46f11e08c53de0b34b27098

Download Submit