17c103b0cd832139aded6213496300760f83abc7922d3829d10f09d422b2b348

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 18:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VMProtectSDK64.lib
Size 7KB
Sample240516-xnb3csbc87
SHA256 c8c4c4d824b42ff38b05bd9f8f3781a63b9318baef087e4e9cf694ac4844a20d
MD5 f8fb5674b416f5f1a8bb4c94d60817c6
SHA1 56092d5cc15023eda121de5ff1aab47e32bc9a11
SHA512 6e37daba16c47d89766665d0b1e7617878cd4e0e2abd0638e5ca3e9366740af0822a05c3fa62d0f60064a9bad4031f8b7e14d6ae5b4570f8326834ef5aa45920
SSDEEP 48:XrZ5/k5RLRzRCRXB6cI15A3Xy/F/CRcRj15T1tRLRyIBrJaFX43KXyAO4YMKUQl+:bjkqBw1xrR3KxKdKJ0DnBRU/rR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\lib_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\lib_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\lib_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\lib_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.lib\ = "lib_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.lib	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\lib_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\lib_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2264	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2264	AcroRd32.exe
2264	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2580	2844	cmd.exe	29
PID 2844 wrote to memory of 2580	2844	cmd.exe	29
PID 2844 wrote to memory of 2580	2844	cmd.exe	29
PID 2580 wrote to memory of 2264	2580	rundll32.exe	30
PID 2580 wrote to memory of 2264	2580	rundll32.exe	30
PID 2580 wrote to memory of 2264	2580	rundll32.exe	30
PID 2580 wrote to memory of 2264	2580	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\VMProtectSDK64.lib
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\VMProtectSDK64.lib
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\VMProtectSDK64.lib"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 e6c562bb82ebdefd5a02e7444333c0300b7ffb405c87a6c8554554a0ca33dff7
MD5 4269c4022cc9b0fb7585488e1aaa6e3a
SHA1 4ec00c3a2245043e828e0685574fdd1f5e0e7cbf
SHA512 a6833bac171ec7947a4ace65ca46a263b3997bbfac6fb5f44e8bafe7fc390096ecffb85005fdb05ca01edd2c5e413bdfa2f87b0ce7cb129f995bdfa005895973
MD5 SHA1 SHA512

Submit Download