5febf594512f13b3374ab927bbb266375e612c6b86f02ccdcb46f52898518bb2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Justice.League.S03.1080p.BluRay.x264-SPRiNTER/Justice League - 03x02 [BluRay][x264][1080p].srt
Size

13KB
MD5

511ad390c2f963bcf2d758db40d610d0
SHA1

04c0cd76e381c6d85a0fe0a573b3e81dc5e5cc77
SHA256

485f3c0894acdd61c264fcb45b3a16a106d1f981eff0edea4121cb4357770dba
SHA512

7e65970080070338b24484f8fd9f8508c63bcef650521b89de69d2a48649716eb2591d73b50efdb701ce6b2e065e107b2fcc250f240ce3f1f0a97c69aae112e0
SSDEEP

384:Lp0RlRWRNuUzPEVWEVS5I9wWs32G+xplKj27:Lp2GNuUz2VSNj32llk27

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\srt_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\srt_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\srt_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\srt_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\srt_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.srt\ = "srt_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.srt	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\srt_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2844	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2844	AcroRd32.exe
2844	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2568	2888	cmd.exe	29
PID 2888 wrote to memory of 2568	2888	cmd.exe	29
PID 2888 wrote to memory of 2568	2888	cmd.exe	29
PID 2568 wrote to memory of 2844	2568	rundll32.exe	30
PID 2568 wrote to memory of 2844	2568	rundll32.exe	30
PID 2568 wrote to memory of 2844	2568	rundll32.exe	30
PID 2568 wrote to memory of 2844	2568	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Justice.League.S03.1080p.BluRay.x264-SPRiNTER\Justice League - 03x02 [BluRay][x264][1080p].srt"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Justice.League.S03.1080p.BluRay.x264-SPRiNTER\Justice League - 03x02 [BluRay][x264][1080p].srt
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Justice.League.S03.1080p.BluRay.x264-SPRiNTER\Justice League - 03x02 [BluRay][x264][1080p].srt"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4122c09133c0cb57087f6b65f2afe8b5

SHA1
71d09779f7f639e24da56f62195570465a664182

SHA256
93acb2b202e882e9c092391cb5f88e3f36df63e360a588abebc7a13b569b5b52

SHA512
3f261dc5607e3d5dc62dae95aed5804a559dd54a5813815c9d2727814899a8d827dde67e43a8d3443640160ccfe80ee975b00771068adfa84e4a30fa1b507129

Download Submit