9d1d18f2ac55866affbe9d63cff31e07785fb104b93b5a754a53c7f123a2f38b

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 10:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

PoseTheCharactersBody/images/camera_anim_pose_01/anim_pose_turn_table_1.0008.exr
Size

8.4MB
MD5

5d9c0bddea8afefbf8e0b7df8105b96b
SHA1

ed82d6190681406212cd4bdbf0dc1902c075ea05
SHA256

a0ab24ea8dd8149335b0e272f3f2a79500d64aa1d0766edb3c35af744be29dd6
SHA512

58bc439185e254b49145ec6ad005822e71c2f3815f6c0ceaf73cf1fba092a6689ea9c764055096399f29d3753eccd1455a1359310017cf0127ba42ac67615d8f
SSDEEP

196608:nlUw85rkOHpIw8yVYz1ejHHZen4foUg/9YAzOga4/8D:+xIwzVjk4fob9hzOgx/c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\exr_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\exr_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\exr_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\exr_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exr	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exr\ = "exr_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\exr_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\exr_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2632	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2632	AcroRd32.exe
2632	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2620	1260	cmd.exe	29
PID 1260 wrote to memory of 2620	1260	cmd.exe	29
PID 1260 wrote to memory of 2620	1260	cmd.exe	29
PID 2620 wrote to memory of 2632	2620	rundll32.exe	30
PID 2620 wrote to memory of 2632	2620	rundll32.exe	30
PID 2620 wrote to memory of 2632	2620	rundll32.exe	30
PID 2620 wrote to memory of 2632	2620	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PoseTheCharactersBody\images\camera_anim_pose_01\anim_pose_turn_table_1.0008.exr
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PoseTheCharactersBody\images\camera_anim_pose_01\anim_pose_turn_table_1.0008.exr
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PoseTheCharactersBody\images\camera_anim_pose_01\anim_pose_turn_table_1.0008.exr"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
35f7153fab7d4aa7aa9a3c1e54536d96

SHA1
55ba66504c91de4504828e05f3e3c37d247b7fff

SHA256
198c777c196e5c237c6725ae0ce6dbe5a16bdf5d067225510fbbc130fc9cafc4

SHA512
4cc5fdbfbb06a0dee76483dc6eeed57068c27655d4ea3533b0b08c03ca71c3c408b194bdb994fcf91eebe502cbd7406f0c822ff75795df249d3283921304ac63

Download Submit