cc3c5a58898a81aa0535462426af70dd0ff896c518ad41d56c7ba2e17d143607

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78A6D2F616BEA044E94822242E947A9C716EC2960AF5130AB430F8AE1DDC49FF.apk
Size

56.6MB
MD5

37b5ac882253b4b20f4ab0dce42d4710
SHA1

b021fcca130f0d353848c84e111fa0f788d8f600
SHA256

cc3c5a58898a81aa0535462426af70dd0ff896c518ad41d56c7ba2e17d143607
SHA512

f544a4df899aa34f137b3d462d2211980d9cd773877f9c4d234e4963c0f8ab552633465fc9ec6c55e94b00d0adea6d7bc38325d21796dd798e2c86c9cf4ba521
SSDEEP

1572864:ZUM2tYv016HFbTTSgx2iGSosw2qkGX2/NhunnFljkeWH+HHKrj5r5Rk:ZUMyobSmPoj5Xw2nnFpkhH+nKrj55e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.apk\ = "apk_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\apk_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\apk_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\apk_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\apk_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\apk_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.apk	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\apk_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2740	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2740	AcroRd32.exe
2740	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2620	2032	cmd.exe	29
PID 2032 wrote to memory of 2620	2032	cmd.exe	29
PID 2032 wrote to memory of 2620	2032	cmd.exe	29
PID 2620 wrote to memory of 2740	2620	rundll32.exe	30
PID 2620 wrote to memory of 2740	2620	rundll32.exe	30
PID 2620 wrote to memory of 2740	2620	rundll32.exe	30
PID 2620 wrote to memory of 2740	2620	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\78A6D2F616BEA044E94822242E947A9C716EC2960AF5130AB430F8AE1DDC49FF.apk
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\78A6D2F616BEA044E94822242E947A9C716EC2960AF5130AB430F8AE1DDC49FF.apk
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\78A6D2F616BEA044E94822242E947A9C716EC2960AF5130AB430F8AE1DDC49FF.apk"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ee47b021d6e8dbc9758eab844196c991

SHA1
93ff45babfdb7ee13ff0edf59624eca5fd9e6db1

SHA256
beb7406324091c63fa1d99b91fa02c92916558f8033f16d2b6b648fc67ba11f1

SHA512
d58b273ba0267ebdbc8bc5909eaf4c07af00adef9df82c8873405a33d7d9d1abb152b4a69e2272d4ef084be6f84c01fcdf36c024a27ccdb85e7147ed48ce46f7

Download Submit