fd0544bdeb691b88a388b2a51da072c4de37b5f7d9af2a1948d45aed755a80a2

Resubmissions

08/06/2024, 16:27

240608-tyk68sdc6z3

08/06/2024, 16:18

240608-tr5bjadb817

Analysis

max time kernel
133s
max time network
142s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08/06/2024, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Electric.rar
Size 37.9MB
Sample240608-tr5bjadb81
SHA256 fd0544bdeb691b88a388b2a51da072c4de37b5f7d9af2a1948d45aed755a80a2
MD5 ed01b80849a848fc3c1285abb66cba4c
SHA1 23cc1b1f8dad47f86dabf71110f6ebfe9c854c12
SHA512 5e0d254690d7f13bf783e905c2481d73ba570fc623d4af4038b3c75fd4e09f45a3185357403d91b4b1d1d4a59ce03b37571b9383b296f5490eba240d690c1853
SSDEEP 786432:Hh5fSYddhTmrs+5ofByRhgYykOF0InSVgEI2/GfEDP6hgkmrvBmYLXWCi:BVSYzhqw2o5J6ISVgEvYo6hgk+fLXWB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
772	OpenWith.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
772	OpenWith.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe
3128	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 3128	772	OpenWith.exe	77
PID 772 wrote to memory of 3128	772	OpenWith.exe	77
PID 772 wrote to memory of 3128	772	OpenWith.exe	77
PID 3128 wrote to memory of 508	3128	AcroRd32.exe	80
PID 3128 wrote to memory of 508	3128	AcroRd32.exe	80
PID 3128 wrote to memory of 508	3128	AcroRd32.exe	80
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 1376	508	RdrCEF.exe	81
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82
PID 508 wrote to memory of 816	508	RdrCEF.exe	82

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Electric.rar
1⤵
- Modifies registry class
PID:2052

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Electric.rar"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:508
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B7B0AEE5AC2C7B0EDEAFD5E502CF6708 --mojo-platform-channel-handle=1620 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F75A82B29A7AF85E108C99EBF463FE68 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F75A82B29A7AF85E108C99EBF463FE68 --renderer-client-id=2 --mojo-platform-channel-handle=1636 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:816
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9C8AB4227C46BA6A2EE724BEE0C75F60 --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E09573F4D520AC1705C2716EB2ABF5D4 --mojo-platform-channel-handle=2392 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FCC30A64593BCC656D066C891E80E0BE --mojo-platform-channel-handle=2412 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 b373e05fd8b68906058cbc5a4d3dd386badc7aadb2936d844d9a1e7be5263949
MD5 9f2a89b96c343b104c74a604d2cfe4b9
SHA1 c991fdf783c47532e23e07dc28fdfa849a81a035
SHA512 fb5c703321f0b953558236e595fa01995d9acde8f778e3e77e5c5d31654f055035f367a254b7dec015112f32bbe61288641a33afeec519835631cfc8da86854e
SSDEEP 384:yetdThptELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:D+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 605cbbe39b5acc5f1424945700f5336370b403b3fd1b8accba725d939a4fe4d7
MD5 8c02de6da43564e5596234ef87be3940
SHA1 b9a10fb7d49f1349a5bd05e8e1f9dd5e0fd1e3ee
SHA512 00b64588933e95a1358ea70dcf88a01d834b7204d7df09536e4c5ec42c88669a693db69a85ae63ee9a09860c546c22d02594f2b32b7ef7d877c27184cd356c91
SSDEEP 384:iefdThptELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:R+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download