9be2103d3418d266de57143c2164b31c27dfa73c22e42137f3fe63a21f793202

Analysis

max time kernel
357s
max time network
360s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

locales/an/filezilla.mo
Size

129KB
MD5

71f6b8b0df7ce00fcde21e41fd4fa6f1
SHA1

babef269e01697f6728e50d32c10a7bc9d8b474a
SHA256

54e3019ca035ba48c32b9a876ad55ad87c18798b8493909aff38e97d2ebb0c0d
SHA512

dd796a919739c5bbee66a6b1cf0330a4e09b2c14a966b18d353116d7ceabf56bf0d9815de3ad7bb286ed3966e7ea6d2d34cb8e22e864b929c93b17bd2c2b767b
SSDEEP

3072:rflp/Hc8wmLSCdt4nITa1X0BTMXBwAh1GM:rNpvVJSkt4nITa1E8BwAh1GM

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\mo_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\.mo\ = "mo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\mo_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\mo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\mo_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\mo_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\.mo	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\mo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2672	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2672	AcroRd32.exe
2672	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2364	1744	cmd.exe	29
PID 1744 wrote to memory of 2364	1744	cmd.exe	29
PID 1744 wrote to memory of 2364	1744	cmd.exe	29
PID 2364 wrote to memory of 2672	2364	rundll32.exe	30
PID 2364 wrote to memory of 2672	2364	rundll32.exe	30
PID 2364 wrote to memory of 2672	2364	rundll32.exe	30
PID 2364 wrote to memory of 2672	2364	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\an\filezilla.mo
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\an\filezilla.mo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\an\filezilla.mo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8b75c1cf70c1355697b4db34aa77dbd7

SHA1
c72417d15239a32cb2724f86086e51caaa80eb68

SHA256
d7a2958685d4e9b45f3ee6705b36655ba80209025bec950a733fd270e4407860

SHA512
7899167a5472465572e77fce771ea6d055b234e0d86d23e42ec50be206d3de321a0f88242c40c58ab6a662703b653974667b87efb64e471c0a3d0b41d2d1ec9e

Download Submit