24fe65718394b79c9d647247a56788d65b3027391ab9f09484705b1d57635818

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

010 Factory Melody.smp
Size

24.6MB
MD5

12055682a696529cdcb726c067be7224
SHA1

b5ef5c821fbaf4fe3cd3c1e5d4eedfef165fb2a8
SHA256

977811e4cf853f2c196cf8f0a024f5b05b75a47a0efc4fc24269e6021aab64a0
SHA512

00621fd3c37d70a4b93e5f219f13a04f0f032dede44e4e6f88b367d532945ca4ff67866ee04f2f22ba05fce1da3bfb9e46fdf3d72161b7599ee42febb945406c
SSDEEP

786432:buTuf8R2XJgzHjROJZEDEd3P/hauuumbs9:bXkGIFOJZEDEdB0s9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\smp_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\smp_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\smp_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\smp_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.smp	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.smp\ = "smp_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\smp_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\smp_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2696 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2696 AcroRd32.exe
2696 AcroRd32.exe

pid	process
2696	AcroRd32.exe

pid	process
2696	AcroRd32.exe
2696	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2940 wrote to memory of 2472	2940	cmd.exe	rundll32.exe
PID 2940 wrote to memory of 2472	2940	cmd.exe	rundll32.exe
PID 2940 wrote to memory of 2472	2940	cmd.exe	rundll32.exe
PID 2472 wrote to memory of 2696	2472	rundll32.exe	AcroRd32.exe
PID 2472 wrote to memory of 2696	2472	rundll32.exe	AcroRd32.exe
PID 2472 wrote to memory of 2696	2472	rundll32.exe	AcroRd32.exe
PID 2472 wrote to memory of 2696	2472	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\010 Factory Melody.smp"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\010 Factory Melody.smp
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2472

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\010 Factory Melody.smp"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2696

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
78a903e06dd855f04a01520604bbacbb

SHA1
b3e4706c73324b2135370804a15229f3b2a7c4e5

SHA256
9a0fd46957831cabda916854113b88b0695532163823d81d250a195330f3574f

SHA512
5a38bd46907e5da71f48504210f095fa216c4d1f2e104a392e83208e17c5b9f3e6d4c2e75557702622a06a6a6c67c3012482d94c8d19b43f60ab670173f7ab6f

Download Submit