24fe65718394b79c9d647247a56788d65b3027391ab9f09484705b1d57635818

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

012 Percussive.wvt
Size

1KB
MD5

d9b1c9f4d3b2c0067aacf6e0478395de
SHA1

b1cafbc733bb5ddad2874fd181d251a185824b61
SHA256

37ff381604bec32617369fc6f9c7a590f28c4733bd3d390d3245662d41844973
SHA512

12f3ced8b8cc4f2177fac378b788117ee69803b21bd9de22f5ca167bf5c204ff9a03ed97867767b5d58c3165b88280a110b47fb1a6491a0754cff4570be48626

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\wvt_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.wvt	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\wvt_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\wvt_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\wvt_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\wvt_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.wvt\ = "wvt_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\wvt_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2704 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2704 AcroRd32.exe
2704 AcroRd32.exe

pid	process
2704	AcroRd32.exe

pid	process
2704	AcroRd32.exe
2704	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2376 wrote to memory of 2552	2376	cmd.exe	rundll32.exe
PID 2376 wrote to memory of 2552	2376	cmd.exe	rundll32.exe
PID 2376 wrote to memory of 2552	2376	cmd.exe	rundll32.exe
PID 2552 wrote to memory of 2704	2552	rundll32.exe	AcroRd32.exe
PID 2552 wrote to memory of 2704	2552	rundll32.exe	AcroRd32.exe
PID 2552 wrote to memory of 2704	2552	rundll32.exe	AcroRd32.exe
PID 2552 wrote to memory of 2704	2552	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\012 Percussive.wvt"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\012 Percussive.wvt
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\012 Percussive.wvt"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2704

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
1195c9e7e5111fc0e71a5b59d5dd0bdb

SHA1
e3a67eb14cad9efe95329463598ee1c3fdc72a91

SHA256
0c384eacd84094288240f6e9fc837d9bc94e200790c7c9d0781523d0b882b842

SHA512
05ea47dd6eb2b59eab7a912861b5f5bd265e31ce83fe94e77d34208582a5fd8cc15901ff7599427be6d18a6cdccfeb6e4c7fea009b52c41e22c96040f029ecbc

Download Submit