Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 07:40
Static task
static1
Behavioral task
behavioral1
Sample
78A6D2F616BEA044E94822242E947A9C716EC2960AF5130AB430F8AE1DDC49FF.apk
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
78A6D2F616BEA044E94822242E947A9C716EC2960AF5130AB430F8AE1DDC49FF.apk
Resource
win10v2004-20240611-en
General
-
Target
78A6D2F616BEA044E94822242E947A9C716EC2960AF5130AB430F8AE1DDC49FF.apk
-
Size
56.6MB
-
MD5
37b5ac882253b4b20f4ab0dce42d4710
-
SHA1
b021fcca130f0d353848c84e111fa0f788d8f600
-
SHA256
cc3c5a58898a81aa0535462426af70dd0ff896c518ad41d56c7ba2e17d143607
-
SHA512
f544a4df899aa34f137b3d462d2211980d9cd773877f9c4d234e4963c0f8ab552633465fc9ec6c55e94b00d0adea6d7bc38325d21796dd798e2c86c9cf4ba521
-
SSDEEP
1572864:ZUM2tYv016HFbTTSgx2iGSosw2qkGX2/NhunnFljkeWH+HHKrj5r5Rk:ZUMyobSmPoj5Xw2nnFpkhH+nKrj55e
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.apk\ = "apk_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\apk_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\apk_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\apk_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\apk_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\apk_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.apk rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\apk_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2740 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2740 AcroRd32.exe 2740 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2620 2032 cmd.exe 29 PID 2032 wrote to memory of 2620 2032 cmd.exe 29 PID 2032 wrote to memory of 2620 2032 cmd.exe 29 PID 2620 wrote to memory of 2740 2620 rundll32.exe 30 PID 2620 wrote to memory of 2740 2620 rundll32.exe 30 PID 2620 wrote to memory of 2740 2620 rundll32.exe 30 PID 2620 wrote to memory of 2740 2620 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\78A6D2F616BEA044E94822242E947A9C716EC2960AF5130AB430F8AE1DDC49FF.apk1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\78A6D2F616BEA044E94822242E947A9C716EC2960AF5130AB430F8AE1DDC49FF.apk2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\78A6D2F616BEA044E94822242E947A9C716EC2960AF5130AB430F8AE1DDC49FF.apk"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2740
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ee47b021d6e8dbc9758eab844196c991
SHA193ff45babfdb7ee13ff0edf59624eca5fd9e6db1
SHA256beb7406324091c63fa1d99b91fa02c92916558f8033f16d2b6b648fc67ba11f1
SHA512d58b273ba0267ebdbc8bc5909eaf4c07af00adef9df82c8873405a33d7d9d1abb152b4a69e2272d4ef084be6f84c01fcdf36c024a27ccdb85e7147ed48ce46f7