32793e0595e6a373be32c8e25c7ea147e72c78102a09a889ada948a164dc86cb

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fogy.deb
Size 63KB
Sample240619-cbemhawdrk
SHA256 e7c62185a743d68a616f89badc4bb2912e0cc9d025ab65245f1b7caa70f17503
MD5 0815ba1d9d6bb6d26fc2cc36c67a6653
SHA1 851cb83d9d3ada0c6c3a1da54f5b731f58b5751a
SHA512 65db95fbd54ca0e52066cd108d1ba07e590c31c332831b0e21bad44fad2c6940032843c117974936b6935aa3e7a44edd9312e7506fd5fd5e79f875eeff79086d
SSDEEP 1536:D6XERpqnEguL98sv353emwQ/Hx4+p3wmGbAuaJHQTGrJym8rW:DaEg23enQ/H+O3wmmamT+JR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\deb_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\deb_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.deb	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\deb_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.deb\ = "deb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\deb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\deb_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\deb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2744	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2744	AcroRd32.exe
2744	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2684	2056	cmd.exe	29
PID 2056 wrote to memory of 2684	2056	cmd.exe	29
PID 2056 wrote to memory of 2684	2056	cmd.exe	29
PID 2684 wrote to memory of 2744	2684	rundll32.exe	30
PID 2684 wrote to memory of 2744	2684	rundll32.exe	30
PID 2684 wrote to memory of 2744	2684	rundll32.exe	30
PID 2684 wrote to memory of 2744	2684	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\fogy.deb
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\fogy.deb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fogy.deb"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 221cd8174e6fb2327ac56fc17547d73425e1c0af522ba586c66aec440353acd5
MD5 dba6323d58eb41142be29c013a4bafcd
SHA1 38de620c4d08a651573b083c64c52eaed52ee6e7
SHA512 97be5ea301b63407862de91ab33703f205d2397cb1cf4883e30a57a13e3fc5783bc527a22695ed7f9f40cca4d5ac54394804ee7d3a149f184eff19f097fdcb45
MD5 SHA1 SHA512

Submit Download