30a0ca3adae2a904fa533369a5157a9e9bf93678794f405b981f15fd2676c6a0

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quest Adventure Installer/JRE/conf/management/management.properties
Size

14KB
MD5

055470250aefd21bb36a38aa74c9d9be
SHA1

a69b8a1d371d0e284490797d0b7bd952b339c92f
SHA256

f80096ec028dcb71625c398ec16d12023cafc6a1c055aceaed07d02e8d56f637
SHA512

f28be5155e8de08d1bc4992b2941e40b56ac3266cab3aa48726c2dd3e720cc2f52dd63713658b4186ac31bd83c2178841ce776c3458cb8577a60c16714c2a643
SSDEEP

192:uRo1ZVZHV+Dq3xtPbDxPqZwNrLTesyuVcAXiiPpkI:ikZTHV+Dq3xtP3xPqaNr/es11v

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\properties_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.properties	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\properties_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\properties_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.properties\ = "properties_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\properties_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\properties_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\properties_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1316 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

1316 AcroRd32.exe
1316 AcroRd32.exe

pid	process
1316	AcroRd32.exe

pid	process
1316	AcroRd32.exe
1316	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2324 wrote to memory of 2696	2324	cmd.exe	rundll32.exe
PID 2324 wrote to memory of 2696	2324	cmd.exe	rundll32.exe
PID 2324 wrote to memory of 2696	2324	cmd.exe	rundll32.exe
PID 2696 wrote to memory of 1316	2696	rundll32.exe	AcroRd32.exe
PID 2696 wrote to memory of 1316	2696	rundll32.exe	AcroRd32.exe
PID 2696 wrote to memory of 1316	2696	rundll32.exe	AcroRd32.exe
PID 2696 wrote to memory of 1316	2696	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Quest Adventure Installer\JRE\conf\management\management.properties"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Quest Adventure Installer\JRE\conf\management\management.properties
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2696

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Quest Adventure Installer\JRE\conf\management\management.properties"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1316

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
927151717dc6073f860802fdd66afdbb

SHA1
1577899dc3db8416f3dd003373a744801c6b8e00

SHA256
99edd6a9feffce60c3c29765daa36910d92398f0bc8fa01b641ac5e030d5d2c5

SHA512
5097732546d1575984b9265624545e1bea3eee32a9a1305d861742be23e4f28cfe58707f0fb7f9121710eea83a374f9ab2ff410cc004e56e0c8a24fb0cea4d03

Download Submit