Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 17:12

General

  • Target

    Mirage 1.16 v0.2/DIM1/forcedchunks.dat

  • Size

    22B

  • MD5

    87e95b37c11f1139dc218d907fbb24de

  • SHA1

    32d7225738c6ee6ae6e526f16d695d77ea4278c3

  • SHA256

    8a1ff1d28cc89befe2b93aec31a800604d46b8e653e6a106d409a240cda20738

  • SHA512

    8fc0c3dbe07eac36330e6a698620deaa7dab18443fe13dacee1cfe7eaa3f18e882aec057f344a50bca5ed5a001541ecab7dd0506206a5d89511c4ee39fce0f14

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Mirage 1.16 v0.2\DIM1\forcedchunks.dat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Mirage 1.16 v0.2\DIM1\forcedchunks.dat
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Mirage 1.16 v0.2\DIM1\forcedchunks.dat"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    329775e396594c964b6f2a758fbfa6b6

    SHA1

    a97160cb30b05780fb2a8e148fe0e9cd7b08bc61

    SHA256

    9ce9bc303e22b064b08bd10b0808e7eb5f21e69854e9c0189320ba25ea798294

    SHA512

    b702487a70bbef62a53051c776272f888552f911ef682a9ecbf4f4608b1ebeb54799d06967868324116760fbe8021a64cb2641988e99a5702ad87a65c9ee95f6