90c6ff44fca26d57b8e3689e61b91ed72777f732584a796e5fd9649634b2a4ed

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:42

Target

Kiwi X External/runtimes/win-arm64/native/onnxruntime.lib
Size

3KB
MD5

d043fafbddefb37a0a33145f1839b807
SHA1

69e4632564e17a0f5c750f61d46217e5a8e376f1
SHA256

b6d73ab6f6a03a9e1f7071fb5681a1ba66edd252b9ceaff554491f8ee667cbb2
SHA512

6fb1e6a8c5b17a0e8ad91c41848e56de7df5f0532e02ce9bbe46ddbf06381e17c356fa0b693d28615d4ec303ee252db2808401386b445a3d5bd2e120d42ae9d1

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\lib_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\lib_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\lib_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.lib	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\lib_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\lib_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\lib_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.lib\ = "lib_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2624 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2624 AcroRd32.exe
2624 AcroRd32.exe

pid	process
2624	AcroRd32.exe

pid	process
2624	AcroRd32.exe
2624	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2444 wrote to memory of 2200	2444	cmd.exe	rundll32.exe
PID 2444 wrote to memory of 2200	2444	cmd.exe	rundll32.exe
PID 2444 wrote to memory of 2200	2444	cmd.exe	rundll32.exe
PID 2200 wrote to memory of 2624	2200	rundll32.exe	AcroRd32.exe
PID 2200 wrote to memory of 2624	2200	rundll32.exe	AcroRd32.exe
PID 2200 wrote to memory of 2624	2200	rundll32.exe	AcroRd32.exe
PID 2200 wrote to memory of 2624	2200	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Kiwi X External\runtimes\win-arm64\native\onnxruntime.lib"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Kiwi X External\runtimes\win-arm64\native\onnxruntime.lib
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Kiwi X External\runtimes\win-arm64\native\onnxruntime.lib"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2624

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4246045ee7fc1101c53de1245100bdd3

SHA1
c258952580a472be75744ead2d968479fa69227e

SHA256
950cb0f1c7a39eb0d5b5dece9f9f9ec2ff6d16f8f2a4f6e8e8f98ee34860be6c

SHA512
ffc48dbd3af3b4bd60d58ea64e77d0cdb92944e308d1c8dfc727b9c64176e7d0047826a8700af155403d67f33ab85463f775ec7201d5689266afb7dab4e3a852

Download Submit