d16dddc1e9ad69c5ef67afd93eb801c74ca5b95ec8b46741786c8c8ec47b1b1d

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.avd
Size

401KB
MD5

5ce1bb147548e1424ee4794a03ffb252
SHA1

a47a088e3fbdf7c3885e7f4b30af24f51f495e64
SHA256

6a20b1d7772edda460ff20333983eee22df3c6090c0128027e44692b623c6b14
SHA512

3f62a70074a238b4aa8a3f980ffa88414e6aa4cea2cbad4646a3581e99827c0156a1dc45232efe7f0642745d5ce1204c5c5569694788cce0cb2f6fdac24cfdc7
SSDEEP

12288:DBdq3/2agl3HgBzXOvOacnFp0wNl4MQpM1OeKAM0:TkuZyXOvyowUOOeLM0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\avd_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.avd\ = "avd_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\avd_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\avd_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\avd_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.avd	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\avd_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\avd_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2596 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2596 AcroRd32.exe
2596 AcroRd32.exe

pid	process
2596	AcroRd32.exe

pid	process
2596	AcroRd32.exe
2596	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2368 wrote to memory of 2592	2368	cmd.exe	rundll32.exe
PID 2368 wrote to memory of 2592	2368	cmd.exe	rundll32.exe
PID 2368 wrote to memory of 2592	2368	cmd.exe	rundll32.exe
PID 2592 wrote to memory of 2596	2592	rundll32.exe	AcroRd32.exe
PID 2592 wrote to memory of 2596	2592	rundll32.exe	AcroRd32.exe
PID 2592 wrote to memory of 2596	2592	rundll32.exe	AcroRd32.exe
PID 2592 wrote to memory of 2596	2592	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\base.avd
1⤵
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\base.avd
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2592

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\base.avd"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2596

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
f0d959b73222959c3c431ccbd08e2389

SHA1
458b5cf957805636b14ffff7cf30f6a7c1b7e2e5

SHA256
3034b6a554d02dc53409d58018a863ea4f0acf5173792ac6bc2340e527bce349

SHA512
d9b185b47eec084932cc2e56a1e7abe8f102adb1af484402c566c40d21f6b32016789abaa4e59c0d3d2039f42a0194cc89f696c6599a356d60ef2119b2b85dab

Download Submit