6dd09e1a8b4e189ca719415e4e9f4aab6f40bf8db872627b3f6396c9476233b3

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Element 3D v2.2 ByDarkDesigner/crack/ElementLicense.license
Size

1KB
MD5

e2d25c8a36f28840ef8af6924b58f043
SHA1

d19102efdf03ee70428ed327c405fd4c9724140f
SHA256

713c6c0f2831f407c16f87026a62b60c0e35af80a759270485a5c3c7a5dc4558
SHA512

e833ce2e01fc51c3a78e953c9fa8bd29667cc36ad9417e51459a5a5a1da340f90b0328cdf1d97dcce1dd4e20c030c4453acaed1e6ee449ed575efba3fbaedfe4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.license	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\license_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\license_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\license_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\license_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\license_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.license\ = "license_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\license_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2900	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2900	AcroRd32.exe
2900	AcroRd32.exe
2900	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 2792	1832	cmd.exe	29
PID 1832 wrote to memory of 2792	1832	cmd.exe	29
PID 1832 wrote to memory of 2792	1832	cmd.exe	29
PID 2792 wrote to memory of 2900	2792	rundll32.exe	30
PID 2792 wrote to memory of 2900	2792	rundll32.exe	30
PID 2792 wrote to memory of 2900	2792	rundll32.exe	30
PID 2792 wrote to memory of 2900	2792	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Element 3D v2.2 ByDarkDesigner\crack\ElementLicense.license"
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Element 3D v2.2 ByDarkDesigner\crack\ElementLicense.license
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Element 3D v2.2 ByDarkDesigner\crack\ElementLicense.license"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
be1d482bc01f96169f2c6c51dea303bf

SHA1
893f3241216530eef0170663bd30e51a51b6e70e

SHA256
9a7f16c7753da1bd88f08e8c7d8871428d7c613f6e011eb87f91ff9840bb2a8c

SHA512
30ab07c78fbd5f3f4ef8d4e7acc943c4c97f76588d72e745be872e3a91deb18db0f54686d577592754e88d7077a14a13438557ed9cf547f6951a4ddc81e34a8e

Download Submit