Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 17:12

General

  • Target

    Mirage 1.16 v0.2/DIM-1/forcedchunks.dat

  • Size

    22B

  • MD5

    87e95b37c11f1139dc218d907fbb24de

  • SHA1

    32d7225738c6ee6ae6e526f16d695d77ea4278c3

  • SHA256

    8a1ff1d28cc89befe2b93aec31a800604d46b8e653e6a106d409a240cda20738

  • SHA512

    8fc0c3dbe07eac36330e6a698620deaa7dab18443fe13dacee1cfe7eaa3f18e882aec057f344a50bca5ed5a001541ecab7dd0506206a5d89511c4ee39fce0f14

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Mirage 1.16 v0.2\DIM-1\forcedchunks.dat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Mirage 1.16 v0.2\DIM-1\forcedchunks.dat
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Mirage 1.16 v0.2\DIM-1\forcedchunks.dat"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    47fb1cbd33e4e40f9800cdc82aea28f5

    SHA1

    cfcb9b1fa0c17753d8f56c63aa9f07ca7922b5b0

    SHA256

    e5fe73bee8c0c64efdbc59f426597f7c7ee2b3aa3a7a50cd1f27795843d8bd2b

    SHA512

    8f79d41f817a7b2359e1ff1ee29f759e97daf8b5d62ba5a9711ab3864e6d5c047be4962e9640157decaae16d2ef8e25f34d70a5a872d42a20568d2cd79ba4334