6dd61f18a3cd350daf98d26c0ce32c935fae9a5458ee6e0d8f9fa843be227e02

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Unconfirmed 977108.crdownload
Size

69KB
MD5

bd7a9eba72d2a2a8cc97260ec906b842
SHA1

ecf9f969b5f2b687aaf73c6173807cdaad151adb
SHA256

6dd61f18a3cd350daf98d26c0ce32c935fae9a5458ee6e0d8f9fa843be227e02
SHA512

8eb5705bba4a86df8b08d3c9b7db67fa382541469905e3196c5d95f02ab77da5bfc60ba2316ae3c9102190bbf8bf09fd642889916a68c4d0452f4f911177ee69
SSDEEP

1536:7LPx4QfgceatqBb1NTaYIjlQYYmatL6ZDngEaSa7XYtHoylWg3HK:7LZ4QoTatqBb1NTaYIRjyL6ZbhaSarYy

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\crdownload_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\crdownload_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\crdownload_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\crdownload_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\crdownload_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.crdownload	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.crdownload\ = "crdownload_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\crdownload_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2480	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2480	AcroRd32.exe
2480	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2604	1084	cmd.exe	29
PID 1084 wrote to memory of 2604	1084	cmd.exe	29
PID 1084 wrote to memory of 2604	1084	cmd.exe	29
PID 2604 wrote to memory of 2480	2604	rundll32.exe	30
PID 2604 wrote to memory of 2480	2604	rundll32.exe	30
PID 2604 wrote to memory of 2480	2604	rundll32.exe	30
PID 2604 wrote to memory of 2480	2604	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Unconfirmed 977108.crdownload"
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Unconfirmed 977108.crdownload
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Unconfirmed 977108.crdownload"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
edbb5af34d63482ab64baf426d124113

SHA1
1660d9e6a1d5e20c4fd1aef6fe1722fbb74b7d83

SHA256
790b7190845ab6e07ed58e30e70eb83c848149d026c01bfb763955c83261526f

SHA512
01aa9e3efbec318431b2dd729d50a73ecc8f7994e7d0692acd94769347134cac131cb5dd66034114d277be324375b44c187e90798c014c091eb7b487cbd1329b

Download Submit