0d23bf28abf8f91db828692cc71ca22209fe7c51b03589ec3f5764447afac870

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Granske.app
Size 172KB
Sample240610-ld2pgsfg76
SHA256 4714b51a71661da35eea60d116ad8f19e7cf8055208d56f6c1b1854c38b8e4fb
MD5 5b3e6e7c3929c14e4cb08ae96d1d2d4e
SHA1 517ddba7fa02d373204bac62001c7a6822edee38
SHA512 f1f5c746965c8f06406b0b6224cf4661db6ae68e7d6c33e9bbfbe5264c4a21a5702f80fad2c8003f275ab77041be31090dfa3b4d4bd54b7ad4247d4df772745d
SSDEEP 3072:aZ/peI3AA1QvQEl2IKD9f/EhulOLPCU8Z5vBPDSifneI45GY9:aZRj1QNU1MuELPCZrPm6e/YC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.app	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\app_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\app_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.app\ = "app_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\app_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\app_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\app_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\app_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2248	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2248	AcroRd32.exe
2248	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 2652	992	cmd.exe	29
PID 992 wrote to memory of 2652	992	cmd.exe	29
PID 992 wrote to memory of 2652	992	cmd.exe	29
PID 2652 wrote to memory of 2248	2652	rundll32.exe	30
PID 2652 wrote to memory of 2248	2652	rundll32.exe	30
PID 2652 wrote to memory of 2248	2652	rundll32.exe	30
PID 2652 wrote to memory of 2248	2652	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Granske.app
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Granske.app
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Granske.app"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 e155bd41ab317e97a79a9b84f68b78552468c563b6a85c2a98de1abf0ea7401b
MD5 f8d4f434e387dfbcfc47743f323e6372
SHA1 831d6a0692332ae978cd5cac71a47174c0ff9208
SHA512 24c3520bb9d20558ce8a37ad8c1b4e2b3cc4c997ef872b7c0211da8824cd7c46c41a6230ee56b8054892c78ae299013f6f0c9bda0ede02d7d6bf03d4f4be2ea1
MD5 SHA1 SHA512

Submit Download