f64b686413ecb81843155b86098f99545046464c4c345e06cdc765467ffedf81

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Black Ops 2 Japanese/english/en_afghanistan.ff
Size

10KB
MD5

fdbc5dc1a2742bf90ff67113611e30cd
SHA1

87cea8de2cba000c9b98977644c2f18127dd628a
SHA256

47bf222368b6c5a944181d5c3f5a526c4cd76f856e7388f2d5fdd27ff610bdc9
SHA512

7bda25997e84e11129a709c78b15f29e9028d1322ea35c2be1439594f47c819241032a5bb588498f10223323c58960e73a5f076ba4595a245d9d5a8659fab330
SSDEEP

192:HH+LYawGw8N3JKlHdoYzRjCRRRS9TvBQWTIkJlzMbZNi:HH2jwtY3JMSoJvBhhnebi

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ff_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ff_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ff_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ff_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.ff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ff_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.ff\ = "ff_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ff_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2348	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2348	AcroRd32.exe
2348	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2716	2108	cmd.exe	30
PID 2108 wrote to memory of 2716	2108	cmd.exe	30
PID 2108 wrote to memory of 2716	2108	cmd.exe	30
PID 2716 wrote to memory of 2348	2716	rundll32.exe	31
PID 2716 wrote to memory of 2348	2716	rundll32.exe	31
PID 2716 wrote to memory of 2348	2716	rundll32.exe	31
PID 2716 wrote to memory of 2348	2716	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Black Ops 2 Japanese\english\en_afghanistan.ff"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Black Ops 2 Japanese\english\en_afghanistan.ff
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Black Ops 2 Japanese\english\en_afghanistan.ff"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5a017d2edec84afbfa17c2cdb23170a5

SHA1
86b6f3d3e297041612981248116eb2f49edbd048

SHA256
d8cedb7faa2a482ac433411748d060bf80384aad2d98dd38e08608377c6e41c2

SHA512
6e9468786dad7c1131bbce9f41331b9b3f996cd473b97e742ad92e17eec09aef526934e3ddaa997d63b0a5641a41130c7cd2deb8224c4b0b919e6e616c2128e1

Download Submit