7635079472f751071c32a41949affd5f1e70a9f01c173f8e1ba0ae41302ea97e

Analysis

max time kernel
102s
max time network
34s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RJ01082861-PC/snapshot_blob.bin
Size

1.1MB
MD5

175d01b0d8f417760f6a85ae0d1981bf
SHA1

7374a51485ea363e747007265c8f70bfcd6bab96
SHA256

4df77f0eb8a8b842a87ba8e7377a86054b444d9ef59ec6c7d111803e3ed61030
SHA512

fef726d0d6efd5226d3149f39e65b9757b9640761488a5ddc3588f239d3aa69799c7bdb4d9aea9b7c12ef86ce421fcda8a58e3e3b4b155a84d781b1197cafe75
SSDEEP

12288:mbzjFh0s0Z4YY1JOfFxrLiQZfjPzs5Qs7OQdpCLUmIjPhRVIEIwMsTheB/IfsiQp:mbzH0I6+QZfLzs5QWO4Dm2hZI8hevf5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\bin_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\bin_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.bin	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.bin\ = "bin_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\bin_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\bin_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\bin_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2696	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2696	AcroRd32.exe
2696	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2540	1952	cmd.exe	29
PID 1952 wrote to memory of 2540	1952	cmd.exe	29
PID 1952 wrote to memory of 2540	1952	cmd.exe	29
PID 2540 wrote to memory of 2696	2540	rundll32.exe	30
PID 2540 wrote to memory of 2696	2540	rundll32.exe	30
PID 2540 wrote to memory of 2696	2540	rundll32.exe	30
PID 2540 wrote to memory of 2696	2540	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\snapshot_blob.bin
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\snapshot_blob.bin
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\snapshot_blob.bin"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2af3ecfc3934d8f50dbdc111bb180308

SHA1
d2912a917c5c933e243da6d1d80e5ab7c3023591

SHA256
32cba84f98424e5ab2cc3359e4bd5a6dd7640492e2c826523e8f8b04aabaecbf

SHA512
2e42bef8e803da7036f1f792fb3c91c210af0089a720709399b1ac0a4ec58cdb6e69904b0a7ca9f62c64bc4099e2a0869b12fb978f9cc8f9be228cb9cbed6049

Download Submit