269fe293247b93422e8882f6a49d39064054b10dbb00ab4d10ec347d8d05f861

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

script.a3x
Size

546KB
MD5

3c381689551d564df57b6f081a8b5742
SHA1

e0f2a50dc6ff45949aec6b61c589cfad5728a355
SHA256

83f1fab236357817270f995a6e3e32f90661dad6d625ad1e1f16b06c248da1d1
SHA512

30fe922119222aecbbb72ecd7ef7e5dc09031832ad00bb6bfabb8d6150d273495b626f9efd1562d0f866f6ba957b243a0a8b10c7d7ca2698ab5d45d434ea6186
SSDEEP

12288:mrdPC2EIxX+Dcsk0GUfllXuQJBmoU6/Tp1vNwZVrIfjpMjR033wI:Q5K9kQ3NTeZGpMjR033f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\a3x_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\a3x_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\a3x_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\a3x_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.a3x\ = "a3x_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\a3x_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\a3x_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.a3x	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2528 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2528 AcroRd32.exe
2528 AcroRd32.exe

pid	process
2528	AcroRd32.exe

pid	process
2528	AcroRd32.exe
2528	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2120 wrote to memory of 2668	2120	cmd.exe	rundll32.exe
PID 2120 wrote to memory of 2668	2120	cmd.exe	rundll32.exe
PID 2120 wrote to memory of 2668	2120	cmd.exe	rundll32.exe
PID 2668 wrote to memory of 2528	2668	rundll32.exe	AcroRd32.exe
PID 2668 wrote to memory of 2528	2668	rundll32.exe	AcroRd32.exe
PID 2668 wrote to memory of 2528	2668	rundll32.exe	AcroRd32.exe
PID 2668 wrote to memory of 2528	2668	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\script.a3x
1⤵
- Suspicious use of WriteProcessMemory
PID:2120

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\script.a3x
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2668

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\script.a3x"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2528

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
b255189115467762feaf1ed31546c350

SHA1
b844ac72436ef69a156cb4baa3e10d7a18eaced9

SHA256
9bd3787af1d3678f7b61dc4a1157723122e263e0417b1789f5d4ab11e4259862

SHA512
2e1eeaa1e693024292d3c290887446cc66ff6bc7d58ad1a5c2ff8722333490433fbf0b21206df0343f1ca8251e010587f81cb5d56e8d3bcecb4b8f746ff38e11

Download Submit