b6ae0fe765ca7755b1496b3c74645daa54d3e9bda37c30c4afdcefdc298fa179

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EDGY/Edgy_Data/sharedassets4.assets.ress
Size

980B
MD5

d587979b81618fbb96f28a37633d3915
SHA1

938897eaf40bdabf7bdef86d19e115d40496d1c5
SHA256

90c44ddeb8d75a3b3370fa37f5c671827f1bd0e2ceb2b10ff2231b0394899b85
SHA512

914ea5d517e4dfb0e5326f0d10abfa5d6af5545531a4e5fbb5a40f6019650196db8e4fb17e5d62efc744e8ad635e70dbe7248d275e2d2a4f36ad0e6d87bdd0e1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ress_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ress_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ress_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ress_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.ress	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.ress\ = "ress_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ress_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ress_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2624	2076	cmd.exe	29
PID 2076 wrote to memory of 2624	2076	cmd.exe	29
PID 2076 wrote to memory of 2624	2076	cmd.exe	29
PID 2624 wrote to memory of 2720	2624	rundll32.exe	30
PID 2624 wrote to memory of 2720	2624	rundll32.exe	30
PID 2624 wrote to memory of 2720	2624	rundll32.exe	30
PID 2624 wrote to memory of 2720	2624	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\EDGY\Edgy_Data\sharedassets4.assets.ress
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\EDGY\Edgy_Data\sharedassets4.assets.ress
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\EDGY\Edgy_Data\sharedassets4.assets.ress"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
00b8bb431a0d39d317d9b119513102ac

SHA1
8501f5ff7fd9eed7c8d74694ad900b12695f39af

SHA256
b55f398111fca15e8947b9324c25047ad84c4ea52251f0e18005e0a7b37deb73

SHA512
6108b0210a119d12ce7a6a96ef4671c9c002a19043c28d83c59d92ea7eb2c3261d4c7cac1bce286e2c4c97dabd217b29f06f365f7ea22595b2f5ddd0c25c405d

Download Submit