eb8afbda006962da47bf99f5ecc2d73ae2d51f293965ae4ad637acbf55108645

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20240611-de
resource tags

arch:x64arch:x86image:win7-20240611-delocale:de-deos:windows7-x64systemwindows
submitted
13/06/2024, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app-32.7z
Size

58.9MB
MD5

721954e061107f6536d40b7871efd239
SHA1

fbd70cd00112a2f200bb4ad4b6b826027df65765
SHA256

4b2bbdd4dd8a7cb44b885263c518dd96065a362def7680553164d1b7cc016e05
SHA512

40a5fc71bfa3a41a5696deea2897eb99ab8cbc28487e486046e34a0ef309079e0b030c49612208348b358e21386d6c286a9a062b23fe0d80bfae1128ca80c913
SSDEEP

1572864:n2shceP6lrFYXNfYx1nhAZFo4rL2n97X3F:n2shPuZYGC04/Yl3F

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1912	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1912	AcroRd32.exe
1912	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2868	2580	cmd.exe	29
PID 2580 wrote to memory of 2868	2580	cmd.exe	29
PID 2580 wrote to memory of 2868	2580	cmd.exe	29
PID 2868 wrote to memory of 2764	2868	rundll32.exe	30
PID 2868 wrote to memory of 2764	2868	rundll32.exe	30
PID 2868 wrote to memory of 2764	2868	rundll32.exe	30
PID 2764 wrote to memory of 1912	2764	rundll32.exe	32
PID 2764 wrote to memory of 1912	2764	rundll32.exe	32
PID 2764 wrote to memory of 1912	2764	rundll32.exe	32
PID 2764 wrote to memory of 1912	2764	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-32.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-32.7z
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-32.7z
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-32.7z"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9237b055dab3da3d5684b36ab6de4324

SHA1
c1c68a1efa12504ff58cefe3debc2da5247f1c13

SHA256
bec2a7c75db1469ad852f377c29ca5762dde1e2fe7095391421fe1a22a1a8a75

SHA512
eb5a00f3bdb050eadb678269f0e8cf44c6b9b1383abacfc096acf1b82bdda008a21f895f22e248eb211c132d380f10617adca85a9f3ced2b71f84bdb6d2f3c93

Download Submit