ace56fea4b7af878e92fa3caa903c1dd21e0b3b43c96ba114e682afa1c2413ed

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:18

Target

Blank-Grabber-main/Blank Grabber/env/Scripts/blank.aes
Size

123KB
MD5

5b4c604aabfb6f39cf254fa4d2dfac8f
SHA1

c6e5d537cfb20bfbce854f52461044745e0101f6
SHA256

eea2bdd556fc2ffbb3315aa30b7d65154b0461d2e9ef3c25a9cc4ff90010d2cd
SHA512

cd76d6ac307f26380081d29fae9c84904059a98e7171b31b723c664daf21df19c9b965b16d1d5e170db03d17988a0a130c1bf90404457bd5a8b3aba2c962a0c0
SSDEEP

3072:JTN0Fo7E+QMte6myPuhABhq97tCGOGNmbKEVjD6LsaDwl3wwohPeaVd:JTCeR4ymhABhqepmO9wMI

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\aes_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.aes	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\aes_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\aes_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.aes\ = "aes_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\aes_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\aes_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\aes_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2840 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2840 AcroRd32.exe
2840 AcroRd32.exe

pid	process
2840	AcroRd32.exe

pid	process
2840	AcroRd32.exe
2840	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1880 wrote to memory of 2784	1880	cmd.exe	rundll32.exe
PID 1880 wrote to memory of 2784	1880	cmd.exe	rundll32.exe
PID 1880 wrote to memory of 2784	1880	cmd.exe	rundll32.exe
PID 2784 wrote to memory of 2840	2784	rundll32.exe	AcroRd32.exe
PID 2784 wrote to memory of 2840	2784	rundll32.exe	AcroRd32.exe
PID 2784 wrote to memory of 2840	2784	rundll32.exe	AcroRd32.exe
PID 2784 wrote to memory of 2840	2784	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\env\Scripts\blank.aes"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\env\Scripts\blank.aes
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\env\Scripts\blank.aes"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2840

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a163d96ceb1cbbd6cf578e38eaf7b497

SHA1
3c753a9a97ee62a1adacece1dd97a1e53345f713

SHA256
4b2f296195a25a1ad99d73beb72123e55f625bd1987d0623c804f9c45407a950

SHA512
758f6eb8d0dceb51d522cde9806dca5730808b3a5cda154e13984914396d08b49778a0f56dcbba01525ae3bf744509852df0a18c215370db2b73bee3a1adcf86

Download Submit