4499dc369b7fe56ee3d2668be8de7e617932f1a6daecb4189a4cdb6a3bc035ba

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Sales Contract 3987420240619.gz
Size

82KB
MD5

2ac7a11c018f5eab414e3ff401baa61d
SHA1

56bc8d9b9703f527eebf04e7ad864006e32d80e0
SHA256

4499dc369b7fe56ee3d2668be8de7e617932f1a6daecb4189a4cdb6a3bc035ba
SHA512

b58b451ea61ded6edfa2f3ae34766dd6232eec3090754d31645a53b10f5425c2c46d5758984ffb30e1ba477c01fa5047e3aac7839c5097044c23797c6da4e694
SSDEEP

1536:wHM+9+iaurpnsDRNB7w71rp1Bho/fQuIKQr6tJijtA0JANbP73fe1DKyZ:wJ4iauFsDLB7w71FhonT1SZnQbPzfCWo

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2924	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2652	2740	cmd.exe	29
PID 2740 wrote to memory of 2652	2740	cmd.exe	29
PID 2740 wrote to memory of 2652	2740	cmd.exe	29
PID 2652 wrote to memory of 2472	2652	rundll32.exe	30
PID 2652 wrote to memory of 2472	2652	rundll32.exe	30
PID 2652 wrote to memory of 2472	2652	rundll32.exe	30
PID 2472 wrote to memory of 2924	2472	rundll32.exe	32
PID 2472 wrote to memory of 2924	2472	rundll32.exe	32
PID 2472 wrote to memory of 2924	2472	rundll32.exe	32
PID 2472 wrote to memory of 2924	2472	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Sales Contract 3987420240619.gz"
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Sales Contract 3987420240619.gz
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Sales Contract 3987420240619.gz
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Sales Contract 3987420240619.gz"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
52095101ad7b2b17b91b67d9904f00d1

SHA1
1445963b47209f00a5feaaf1f7591540f723d96d

SHA256
0d5b14d5f3be8dd32d82df41003f9441877318c044905079a0fb05e800944b77

SHA512
ea293fb405dc0f541db5ce36d3fc4c847b37306b7937abbbdf3bd30ef99bb3f4d333db4cb46061ffc45b93368a33def8b8cd6d31340c79b26e5fb4490013b4e1

Download Submit