97350048ae55d0f3f4fa98c2d00351ce04cf0ed7ec5b191379f25f045a14ab41

Resubmissions

20/06/2024, 03:53

240620-efl89a1hmp 7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

MegaHackInstaller/translations/qt_ca.qm
Size

205KB
MD5

1d351670ea821db3bbb5aee0ad186f10
SHA1

ac0548eb87e7e4a12a604523713e5b08df88fb50
SHA256

235f502810d5750a47421d3e57620dcae5cfcfd83bc97766ad8b99b75238a544
SHA512

7a769f0c0858c25ebbbdd25c7308523ed298e35e2b5533981967773cf7d08899d81d05d34d67567bb48fb0de21b3ce9c9d83866ec701dc841f8b430eadb43e29
SSDEEP

3072:GQKRldlzfzvZfeW+6kXEVjSVPzC3ceKdP2:aff7UW+WjwP2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.qm	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.qm\ = "qm_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\qm_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\qm_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\qm_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\qm_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\qm_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\qm_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2260	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2260	AcroRd32.exe
2260	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2780	2444	cmd.exe	29
PID 2444 wrote to memory of 2780	2444	cmd.exe	29
PID 2444 wrote to memory of 2780	2444	cmd.exe	29
PID 2780 wrote to memory of 2260	2780	rundll32.exe	30
PID 2780 wrote to memory of 2260	2780	rundll32.exe	30
PID 2780 wrote to memory of 2260	2780	rundll32.exe	30
PID 2780 wrote to memory of 2260	2780	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MegaHackInstaller\translations\qt_ca.qm
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MegaHackInstaller\translations\qt_ca.qm
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MegaHackInstaller\translations\qt_ca.qm"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1075d8a976fb3d0aba2c79854c83ca74

SHA1
3d3cd7066f65f3dd3932e1d857f7cd99ab1ebe59

SHA256
d2c229d93ee1e760ee516047e2caff246dfe657f29885fc206fba12bdc6f3de3

SHA512
5077037cd5f0fc7bc482d9d122611975d95aa4ed97f0cb64db6cee5c89ff2b15009a9622e54a12d00767ca5932db1bea3d7d519f47047abb5e7ceeaeaaf18f0c

Download Submit