442bc1d9cc915c514f56d07d44d05d8caab80ae521e29f5a2a3b54058d77aa95

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.tar
Size

72.0MB
MD5

14c7fb85fdf6c4a11f6c19373d2d2a88
SHA1

2b79348fd8f751b59cdba7438b162a11391eb0cf
SHA256

bf9b1736682e66457ad1d91d197ab6ba8f76c7cb9b9aaaa756fa09cf287c5565
SHA512

c51d45da87a46fdd3faf25318a3726cba799bafde89d885c08cbcfd4481dae06791c4f7815162ba7b9e049516ac2b57041e5d3e6688cda28ce31f900929c107b
SSDEEP

49152:wtvgjJjaM7DdI3tHig45Akf3HBcxzSmLnQZsX3LxxmJSzG775ktP10yCWiAuy9wp:z

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2668	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2668	AcroRd32.exe
2668	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3032	2988	cmd.exe	32
PID 2988 wrote to memory of 3032	2988	cmd.exe	32
PID 2988 wrote to memory of 3032	2988	cmd.exe	32
PID 3032 wrote to memory of 2784	3032	rundll32.exe	33
PID 3032 wrote to memory of 2784	3032	rundll32.exe	33
PID 3032 wrote to memory of 2784	3032	rundll32.exe	33
PID 2784 wrote to memory of 2668	2784	rundll32.exe	35
PID 2784 wrote to memory of 2668	2784	rundll32.exe	35
PID 2784 wrote to memory of 2668	2784	rundll32.exe	35
PID 2784 wrote to memory of 2668	2784	rundll32.exe	35

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample.tar
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\sample.tar
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\sample.tar
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\sample.tar"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7d665b5c7b44a2709942f65b4615d217

SHA1
1babcd0b6318ddba2c06cfbdb0f0658703de6be8

SHA256
c614799d2a2cc4134781e48780407f506ea010faa3d7902ab6496ea584152369

SHA512
3721927c38e6cb0c515114172a9a0cb61c165c053621513cbaf3fb35c47ac5ae8f088ff77e740c50a04c206c54fe2a185b089359e2c7b062736e2b92354fb4b3

Download Submit