b7111d51e5a77bca18ad278cee2b990937ab9e23d58b60f7d6f16093a0971906

Analysis

max time kernel
102s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dheater-0.4.3/data/dhparam-ffdhe-3072.pem
Size

595B
MD5

34194b5b67237ead3e08874fc0ae88c9
SHA1

a821ce7e823eddca76adb5f9f3f247f7d0db42aa
SHA256

c410cc9c4fd85d2c109f7ebe5930ca5304a52927c0ebcb1a11c5cf6b2386bbab
SHA512

0c8db8fc0ef144273438d8ba6a363a240964a7e77a55739bae50f8f86994c6b3bd5d05935a3d247e84d6821b9761c014750897a16ed653c19944b58f4a9aca45

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\pem_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\pem_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\pem_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\.pem	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\.pem\ = "pem_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\pem_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\pem_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\pem_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2644	AcroRd32.exe
2644	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2908	3040	cmd.exe	30
PID 3040 wrote to memory of 2908	3040	cmd.exe	30
PID 3040 wrote to memory of 2908	3040	cmd.exe	30
PID 2908 wrote to memory of 2644	2908	rundll32.exe	31
PID 2908 wrote to memory of 2644	2908	rundll32.exe	31
PID 2908 wrote to memory of 2644	2908	rundll32.exe	31
PID 2908 wrote to memory of 2644	2908	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dheater-0.4.3\data\dhparam-ffdhe-3072.pem
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\dheater-0.4.3\data\dhparam-ffdhe-3072.pem
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dheater-0.4.3\data\dhparam-ffdhe-3072.pem"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1f183d422d9b0326eb49da1e82a583e0

SHA1
15d255c50a189c7cf0b5569d12b28ddbd7e8e9ee

SHA256
f686e9f831861fdd6ab0bd403ac0a58cc86fe1d8681b7db9f811f99f899f509e

SHA512
1bd6b7c6867cf2564384ecb9972b69b4687655d97e03c4c9c5b31581dea0ebf3528cee131eac2a4d0a1bfb017320eb09aa80be0f4b477a82ca6f318df2d542c5

Download Submit