fc788d41f02145ba4f9086674464826cc596a0843b73b285f2ae3426439b2d82

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Main/ClientMovementInput.class
Size

4KB
MD5

3f39be05b9969a5fc4a013ffecc9416c
SHA1

9a1b08bc2511d7a9eec9a4a5d22344a5fe724ce5
SHA256

e74c49e443131c17588c1d5abbfcc179e73fa3cfc7ef614d8a98474773b30c57
SHA512

0196836a43438f1b62339b6292bf330d6d399092fcc40b18996445055fb13156d9644e670d05e05ba9ca57f5254a8b5610c98db2a8d183d3ded495ecaa0993da
SSDEEP

96:2CrG3QYNOl7nC8fkBto+9S8hfwCltJxTxKWGxQQftWuDkfRwLV9YS7oJSND48R9p:TflzOaU6WfMnvLfdFR9hL

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\class_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.class	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\class_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\class_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2752	AcroRd32.exe
2752	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2656	1628	cmd.exe	29
PID 1628 wrote to memory of 2656	1628	cmd.exe	29
PID 1628 wrote to memory of 2656	1628	cmd.exe	29
PID 2656 wrote to memory of 2752	2656	rundll32.exe	30
PID 2656 wrote to memory of 2752	2656	rundll32.exe	30
PID 2656 wrote to memory of 2752	2656	rundll32.exe	30
PID 2656 wrote to memory of 2752	2656	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Main\ClientMovementInput.class
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Main\ClientMovementInput.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Main\ClientMovementInput.class"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f9ae839e7ceb8a3157ed7d654320ed84

SHA1
4790c633204a040cb6663de7229ad03dfbcf366f

SHA256
dbb47ac4d10d3ffa4d9c7a1a86a66573bb44f39d8ccdb299352e051353fdf5cd

SHA512
3a085336babeb3e3cbce3f9d7cc0ad8383648339ae446d72c3e5f21bf40271ae82a4df3291e22daad46fbddf1c02955d6fca6af21a4db8f57eaf3abfecfb2163

Download Submit