4887920ef09966bfd09a3930b12912f64c22d52eb9c11f228581de1aab9e5dae

Resubmissions

07/07/2024, 11:29

240707-nlxrlstcmd10

07/07/2024, 11:29

240707-nlmlms1cjq3

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20240704-de
resource tags

arch:x64arch:x86image:win7-20240704-delocale:de-deos:windows7-x64systemwindows
submitted
07/07/2024, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
v8_context_snapshot.bin
Size 643KB
Sample240707-nlxrlstcmd
SHA256 38bd3610023c1f6bae1452096bdc3298a90baea4438afa08a74584aa75f997f1
MD5 bbc5480d9f231e5d0564edbb2a53284c
SHA1 87a6ea5db959ed7b038cc6edb2676263576490de
SHA512 d75aaa676710b1629c3e99cd60e185e5bc67e8d9f65d3f875daa88b7fc229c430fa52d02d799a703488375be39c7ea268170e5bd21cd9ccfbc8dcd86234e6168
SSDEEP 6144:gPm2hiHvnyB2vD5zwqIH2jjHnL3GWaa/rTKaU8STvx/scy7syEI92WkPZ2Ak:KkHPdvLHjGWaarO3/rasg2lPk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.bin\ = "bin_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\bin_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\bin_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\bin_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.bin	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\bin_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\bin_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2836	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2836	AcroRd32.exe
2836	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 1852	2344	cmd.exe	31
PID 2344 wrote to memory of 1852	2344	cmd.exe	31
PID 2344 wrote to memory of 1852	2344	cmd.exe	31
PID 1852 wrote to memory of 2836	1852	rundll32.exe	33
PID 1852 wrote to memory of 2836	1852	rundll32.exe	33
PID 1852 wrote to memory of 2836	1852	rundll32.exe	33
PID 1852 wrote to memory of 2836	1852	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\v8_context_snapshot.bin
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\v8_context_snapshot.bin
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\v8_context_snapshot.bin"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 8d00e793cae7ad3bf1d5caacaa69245a0bc6acdca526b2483ac6be12ae1da7fb
MD5 89bb66b0cc92150b78bd632bac18d2be
SHA1 938528617747184562e9d88e960517ad8b4af707
SHA512 21a1dfa2a4aed89e6ae10bc10fd19ca16279a249032faaa9a37261f8823a3db4b4cc36d452025e0fc9f63af414661abd6d76ed98ea3ba14e32b3b3c43bf968bf
MD5 SHA1 SHA512

Submit Download