9d1d18f2ac55866affbe9d63cff31e07785fb104b93b5a754a53c7f123a2f38b

Analysis

max time kernel
119s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PoseTheCharactersBody/images/camera_anim_pose_01/anim_pose_turn_table_1.0002.exr
Size

8.4MB
MD5

7f05acc81687cd5e43584105125f8463
SHA1

b0b16f42669aba1a0766bef88dc8c375a1e5720b
SHA256

dc7ef938d6bdcf6491b2c68dc13f3f6d0d3c4562e0f16a066138e10d8dc17ba4
SHA512

60c0e38823a88c0c10efbf7dfa282b2e9234389d78e0b0b699ccb24019e1811ce9295a43945a959ea52873a031303554b3ad49c5ced753cdb0de9262ac30c3e3
SSDEEP

196608:AIGqG+oOHpT4yM3N5hyqz860doZg0qfhcD4pC8PXri+pGhrAlQc8QYHB/TU:ATqtoA8yM3N5FT0doZxq6chWdh8lKhbU

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exr_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exr\ = "exr_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exr_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exr_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exr_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exr_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exr	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exr_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2656	2076	cmd.exe	29
PID 2076 wrote to memory of 2656	2076	cmd.exe	29
PID 2076 wrote to memory of 2656	2076	cmd.exe	29
PID 2656 wrote to memory of 2720	2656	rundll32.exe	30
PID 2656 wrote to memory of 2720	2656	rundll32.exe	30
PID 2656 wrote to memory of 2720	2656	rundll32.exe	30
PID 2656 wrote to memory of 2720	2656	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PoseTheCharactersBody\images\camera_anim_pose_01\anim_pose_turn_table_1.0002.exr
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PoseTheCharactersBody\images\camera_anim_pose_01\anim_pose_turn_table_1.0002.exr
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PoseTheCharactersBody\images\camera_anim_pose_01\anim_pose_turn_table_1.0002.exr"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5721a3b01c90b8dbf6f7a1618354cb52

SHA1
a69e637dd1208c93118300cc47c245696d0fcfb0

SHA256
674b6dbb5f51c46af63e9afb3b5d3f8d228acd9540b82be316f797a122679a2f

SHA512
ea52dccc16ce0e0adcb7ce05927803619828e66c87a0378c87303cb416465c03934739ae72310fdd349b3875f27e89d4bfe57d54b499850b8136b5bfe64440a8

Download Submit