479f024e77b53300da8dd0e0d0243dca32af5c1aefaa2f254127bc59f2901d93

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app-64.7z
Size

70.7MB
MD5

3ffffd470f1dd6b44a52ae29a9bd105c
SHA1

dcabc58eb8c156c2b79053cc710e2a9b820c112d
SHA256

adc513c48cd959732f95a403b623a3e3103e82531be23c842a36b9cfc5966529
SHA512

0f35e0e012c0459623a262fb65cad470d23e04c23c5b9a29986f974bbab8b63048f2014b2049568a4deaa9a38531ee48700ba8eeeea0d64cef9cff6cee80a478
SSDEEP

1572864:zPkJopD1LOyqK3yf555SMbDaanxGb8zL5VWtUYv6f87M+mTnMpcOqG:z3pDkKQj5DmanxGSL5VWWhfmMBMpcDG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

rundll32.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

3032 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

3032 AcroRd32.exe
3032 AcroRd32.exe

pid	process
3032	AcroRd32.exe

pid	process
3032	AcroRd32.exe
3032	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 2208 wrote to memory of 2720	2208	cmd.exe	rundll32.exe
PID 2208 wrote to memory of 2720	2208	cmd.exe	rundll32.exe
PID 2208 wrote to memory of 2720	2208	cmd.exe	rundll32.exe
PID 2720 wrote to memory of 2520	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2520	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2520	2720	rundll32.exe	rundll32.exe
PID 2520 wrote to memory of 3032	2520	rundll32.exe	AcroRd32.exe
PID 2520 wrote to memory of 3032	2520	rundll32.exe	AcroRd32.exe
PID 2520 wrote to memory of 3032	2520	rundll32.exe	AcroRd32.exe
PID 2520 wrote to memory of 3032	2520	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z
3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2520

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3032

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
583e3478d89dc7d8cd4b0901287cfbec

SHA1
b5023a807b0e8d8690398c332a88c87851e406bd

SHA256
d642a1f8906418b8b8e02a7ba7f0098f1bff2823a8ad4f60594a991a08520dae

SHA512
8e5b8e17d9a1acc2eadee652a174d061e382276baba5258449b9d889f8be63e0bf3376d4d27235d3afe9f9c33841f330d53a2bb472b2690596e2ed00cf50abd0

Download Submit