24fe65718394b79c9d647247a56788d65b3027391ab9f09484705b1d57635818

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

001 GM Rhythm.pth
Size

63KB
MD5

822bd645d56d3bc352e4573c0b0c6ccd
SHA1

bf520c87f13db48d1ca638960da10f6554bb4f23
SHA256

dcc789142b45f2ce2c2c789d8150319942d3dee0148a0a08aea6b47bdd4d070d
SHA512

ab1349449dafb1d8753d8d0efda484e9a406905d288772047d32f318b1bddf324ba018a5101f9437fb925204c45d6ff6568c9c3f69af53625a67e11837849468
SSDEEP

192:GpBBBBpsvJBBBBHDsvzBBBBTsvVBBBBisvhBBBBafFnBBBBlsvlBBBBD5v4+XBBB:L

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pth\ = "pth_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pth_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pth_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pth_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pth_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pth_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pth	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pth_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2708 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2708 AcroRd32.exe
2708 AcroRd32.exe

pid	process
2708	AcroRd32.exe

pid	process
2708	AcroRd32.exe
2708	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1736 wrote to memory of 2152	1736	cmd.exe	rundll32.exe
PID 1736 wrote to memory of 2152	1736	cmd.exe	rundll32.exe
PID 1736 wrote to memory of 2152	1736	cmd.exe	rundll32.exe
PID 2152 wrote to memory of 2708	2152	rundll32.exe	AcroRd32.exe
PID 2152 wrote to memory of 2708	2152	rundll32.exe	AcroRd32.exe
PID 2152 wrote to memory of 2708	2152	rundll32.exe	AcroRd32.exe
PID 2152 wrote to memory of 2708	2152	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\001 GM Rhythm.pth"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\001 GM Rhythm.pth
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2152

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\001 GM Rhythm.pth"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
863960f73e68b3264c347523de0ce7b6

SHA1
45472705010c31079135533a038eebc37cbe4969

SHA256
e9baba610f2d9dcd7171294badde0e844e6056af0f3d34edd953407a335231c4

SHA512
ba3a3073fd5ca8a4ecd6c61e1ec07d1b22432fc87b01028ce54204695d732dbf8139fba0d865acc6508b78c1f0251769eacb41d5af8654c0fea3e22a683fae84

Download Submit