71ce71735aa47a3b1d17e1b6639aaf6213b4c284243ad5ae7bb36fa1c5c9975f

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpyNote_v6.4/Resources/Imports/Payload/stub.apk
Size

730KB
MD5

0c0290abde03555f3c66c81eba860a3d
SHA1

939a8e6d0ed4bd8c9f491405ecf069df7bddb7cc
SHA256

7b20a276931c8625b39ebc46017c7e4d4a7bdf319b9f451231d777b078b0cd6a
SHA512

441922d41856ec246d1cb29e3b290b62b2d3bc4ca54f896af1df72263e67a320f1b3b85f4d5bd129fa32b4633a1b9f74a63783791f1ea1cb1ca97a8a26b8ea48
SSDEEP

12288:CJc+EIBvAvcKIth8eGz3zaR9QHqd8gmw+/goe13VvqX:CJc+EIO0K4KeGTzaR+imz/goeHvqX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\apk_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\apk_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\apk_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\apk_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\apk_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.apk	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.apk\ = "apk_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\apk_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2588 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2588 AcroRd32.exe
2588 AcroRd32.exe

pid	process
2588	AcroRd32.exe

pid	process
2588	AcroRd32.exe
2588	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1620 wrote to memory of 320	1620	cmd.exe	rundll32.exe
PID 1620 wrote to memory of 320	1620	cmd.exe	rundll32.exe
PID 1620 wrote to memory of 320	1620	cmd.exe	rundll32.exe
PID 320 wrote to memory of 2588	320	rundll32.exe	AcroRd32.exe
PID 320 wrote to memory of 2588	320	rundll32.exe	AcroRd32.exe
PID 320 wrote to memory of 2588	320	rundll32.exe	AcroRd32.exe
PID 320 wrote to memory of 2588	320	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SpyNote_v6.4\Resources\Imports\Payload\stub.apk
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SpyNote_v6.4\Resources\Imports\Payload\stub.apk
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:320

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SpyNote_v6.4\Resources\Imports\Payload\stub.apk"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2588

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
6ff59cf558997806cf25eda8f0cb08fe

SHA1
42ca72ed3dbbda301a4ccddaedfe05ba344ca624

SHA256
ac6d443824add6b344c904119764866e3fcdb7abba5eb43eb8a5bbdec804eaa3

SHA512
393d0d9cde63480c04db8bac605de7ea694b547d4ea3172dd2082497c5335b1e9b13e0d01960127a12aae553c8af8026e9a137e0df55e390c965682da8737139

Download Submit