493a87821844ece939c8e23b0ed03c727e885c8afb47b40abb1a6f3b90109a63

Analysis

max time kernel
33s
max time network
20s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:07

Target

System Voleume Information pcaps/f2e83873-ad5c-4abb-b0d4-e3b752b1f46f.pcap
Size

15.8MB
MD5

5106122aecb27dc5e095c137beb161ed
SHA1

0f36ee4f2dcaa7e8c0d863c762d8720d3210b947
SHA256

595f5c09f39423a9be52175c748f180a2575e7fbce32a1b19284e81347f74991
SHA512

482c905dc055ab35a55b4d034f43d4c31133c3c3110906ed0eb872482cf9097bd66ebbedb2011aef4e4e7a7814af46058238e91a3b4151e4bcf8be78533bdfa4
SSDEEP

196608:vZMdyBuLpqB+Ns7XP4Be14eVpobRZKoRmuJjkZ5oM1lnrgb0/sWx1u3FR7zFFQdu:aYU1w+qP6eKDWfIu9ycsWzuL3T/

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pcap_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pcap_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pcap_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pcap_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pcap_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pcap	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pcap\ = "pcap_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pcap_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2456 AcroRd32.exe
2456 AcroRd32.exe

pid	process
2456	AcroRd32.exe
2456	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1760 wrote to memory of 2524	1760	cmd.exe	rundll32.exe
PID 1760 wrote to memory of 2524	1760	cmd.exe	rundll32.exe
PID 1760 wrote to memory of 2524	1760	cmd.exe	rundll32.exe
PID 2524 wrote to memory of 2456	2524	rundll32.exe	AcroRd32.exe
PID 2524 wrote to memory of 2456	2524	rundll32.exe	AcroRd32.exe
PID 2524 wrote to memory of 2456	2524	rundll32.exe	AcroRd32.exe
PID 2524 wrote to memory of 2456	2524	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\System Voleume Information pcaps\f2e83873-ad5c-4abb-b0d4-e3b752b1f46f.pcap"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\System Voleume Information pcaps\f2e83873-ad5c-4abb-b0d4-e3b752b1f46f.pcap
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\System Voleume Information pcaps\f2e83873-ad5c-4abb-b0d4-e3b752b1f46f.pcap"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2456

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
21adfa89489b5d6aab13004eb4c1f8d2

SHA1
0a47c8334d76cb62190581944d448d294a8c9d42

SHA256
33d829c8b672e330f4acc499141872d60651fec2455f6221d3e1cc5d659618cb

SHA512
fb2b7c24400026229aa34ad329237804baa9604fcbd61b867d91c86d8dd6fab9897450ef55f61e9168bff4fc32da0b033a445193a30927fa6ffa6bba703dcfbb

Download Submit