c911fc796b9bf671e9d239a637e14f44f55cf8617e7a76bbbfdde77d89152faa

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GS.bin
Size

4.0MB
MD5

d912d0fa9f995e4dd4a3499066e423d2
SHA1

f98bbd4cf0675eeaa9db527d94197ff7a4e9a6c1
SHA256

f3f66dff8b624c46646e7cc1ef30cde9ac9799addda0e60e4d69446032e53c2f
SHA512

15bd801fe3e894efa1f632d4631e0671e14695dbac1de4ae519bfe9c9bc90bd650ddcb2b2a610bf912dc985b0b0ab0826df23880fec1db39d36195656613e3fa
SSDEEP

12288:ixNKg4nIal++++++Y++P++7++m+Erh/RI2BEcCz++87OKDUyY3M+TsLcXLrBxdxI:ixElrqt9vLQPP2V2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\bin_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.bin	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.bin\ = "bin_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\bin_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\bin_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\bin_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\bin_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2636 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2636 AcroRd32.exe
2636 AcroRd32.exe

pid	process
2636	AcroRd32.exe

pid	process
2636	AcroRd32.exe
2636	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2480 wrote to memory of 1804	2480	cmd.exe	rundll32.exe
PID 2480 wrote to memory of 1804	2480	cmd.exe	rundll32.exe
PID 2480 wrote to memory of 1804	2480	cmd.exe	rundll32.exe
PID 1804 wrote to memory of 2636	1804	rundll32.exe	AcroRd32.exe
PID 1804 wrote to memory of 2636	1804	rundll32.exe	AcroRd32.exe
PID 1804 wrote to memory of 2636	1804	rundll32.exe	AcroRd32.exe
PID 1804 wrote to memory of 2636	1804	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GS.bin
1⤵
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\GS.bin
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1804

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GS.bin"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2636

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
863f51f16a4365ea8b2b521b76432346

SHA1
adbfbc0bcb887a18e2376c93e8f2f838c2d9c955

SHA256
4abb07365061b9d25c9362cc70ae37705a86f76354061a2d84eca1af17cbc7ea

SHA512
255002e8fc0deba0933fd2a78e6a43d7fc65ce2f097331b4ee37c00adfc58b4376931b821fbd43293b2327f2344d6f3819ffadb17ce738727c4e8b834014a730

Download Submit