68f7bba728553d869045023be6b80b5ac87e32b761ec5e754844e220ebcafeb3

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NON-HLOS.bin
Size

7.7MB
MD5

fa1f5e973d99df48809869b7845b8e68
SHA1

7cd7ce30efbc07596ed2eb7ebd67a51dcba6db02
SHA256

61621365e4dd7cc3553982115e454cfda9cbf9c04e9ff490099e875cd2f2933a
SHA512

1e48c26a703139fb6db6421cecff944c37c321ad2f6df19c3692fae5da7dc0e9c2d5668ef1a3608349b37e775183f227e3ab94227ff5f6f3bd0f7be581cc321f
SSDEEP

98304:iD0I4kM/5VScmDLAdMA+EKDmDnnQH+MK/:eUADmDnV

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\bin_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\bin_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.bin	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\bin_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\bin_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.bin\ = "bin_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\bin_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2460	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2460	AcroRd32.exe
2460	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2556	3024	cmd.exe	29
PID 3024 wrote to memory of 2556	3024	cmd.exe	29
PID 3024 wrote to memory of 2556	3024	cmd.exe	29
PID 2556 wrote to memory of 2460	2556	rundll32.exe	30
PID 2556 wrote to memory of 2460	2556	rundll32.exe	30
PID 2556 wrote to memory of 2460	2556	rundll32.exe	30
PID 2556 wrote to memory of 2460	2556	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NON-HLOS.bin
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\NON-HLOS.bin
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NON-HLOS.bin"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e0fdad0dc09058536618ead1040bfd63

SHA1
2cb24b461974b3bfbe2ae5e1974d6e0de61964b5

SHA256
d9e0335efe1d82bfd4187502f7a601aff3f74fcbc054c2d6d1927ae94c2dfe22

SHA512
147add1798c5247c0ddf5e790b17589790cafa88d1f4d85ba3a2a2cbaf0c8fe4243d8203d3953fec47da82cdae2f8710928fb2ea0add15e46e768b67c8bc0443

Download Submit