5febf594512f13b3374ab927bbb266375e612c6b86f02ccdcb46f52898518bb2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Justice.League.S03.1080p.BluRay.x264-SPRiNTER/Justice League - 03x09 [BluRay][x264][1080p].srt
Size

17KB
MD5

3515d387a03a7327040dd7dce67c50d1
SHA1

acaee35f37035315bd701eafb72b282ece899578
SHA256

984fd826fb3754249ef458469feb4a485d24f1dc03df6b28a00b4c19a94e813e
SHA512

fcc18b2adfa06d6960ea4e21e9b9f06766973c3904ca48b22e61384052fa0b8ceafcb08fb7ee827e04b1bc99796c90ce9596659b41bb03248319430824945b9e
SSDEEP

384:WXfAuuHqrQAWrGOngig7T3UCETJeou6GEtNGcN7:WXfAu7chgBvduD3N7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\srt_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\srt_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\srt_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\srt_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.srt	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.srt\ = "srt_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\srt_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\srt_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2628	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2628	AcroRd32.exe
2628	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2652	2972	cmd.exe	29
PID 2972 wrote to memory of 2652	2972	cmd.exe	29
PID 2972 wrote to memory of 2652	2972	cmd.exe	29
PID 2652 wrote to memory of 2628	2652	rundll32.exe	30
PID 2652 wrote to memory of 2628	2652	rundll32.exe	30
PID 2652 wrote to memory of 2628	2652	rundll32.exe	30
PID 2652 wrote to memory of 2628	2652	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Justice.League.S03.1080p.BluRay.x264-SPRiNTER\Justice League - 03x09 [BluRay][x264][1080p].srt"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Justice.League.S03.1080p.BluRay.x264-SPRiNTER\Justice League - 03x09 [BluRay][x264][1080p].srt
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Justice.League.S03.1080p.BluRay.x264-SPRiNTER\Justice League - 03x09 [BluRay][x264][1080p].srt"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f55ef45536ecd4a6c9e892294aa59319

SHA1
e1c07bcd92dbc2f8a396de555ab4a9f1637bf262

SHA256
e0cac9083c47e9d91c0291c48ece73621daf4ed72a74b564265822a4e7727064

SHA512
728a152eb52beafcfe89ee407d7f52bdb81d8f314b825bbd0aacf8cefd89005e8ed291ae9fda5db4e64793dbadad9f3ae7a074ef88f9318e0f814d486c696d49

Download Submit