b7111d51e5a77bca18ad278cee2b990937ab9e23d58b60f7d6f16093a0971906

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dheater-0.4.3/data/dhparam-ffdhe-4096.pem
Size

769B
MD5

6377960551b81b27240486a0e2680ef8
SHA1

fbd4c88a127d6a8565956f88bcd46149868a6cda
SHA256

64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
SHA512

716a462baecb43520fb1ba6f15d288ba8df4d612bf9d450474b4a1c745b64be01806e5ca4fb2151395fd4412a98831b77ea8dfd389fe54a9c768d170b9565a25

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.pem\ = "pem_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pem_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pem_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pem_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pem_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.pem	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pem_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pem_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2548	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2548	AcroRd32.exe
2548	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2740	2872	cmd.exe	31
PID 2872 wrote to memory of 2740	2872	cmd.exe	31
PID 2872 wrote to memory of 2740	2872	cmd.exe	31
PID 2740 wrote to memory of 2548	2740	rundll32.exe	32
PID 2740 wrote to memory of 2548	2740	rundll32.exe	32
PID 2740 wrote to memory of 2548	2740	rundll32.exe	32
PID 2740 wrote to memory of 2548	2740	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dheater-0.4.3\data\dhparam-ffdhe-4096.pem
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\dheater-0.4.3\data\dhparam-ffdhe-4096.pem
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dheater-0.4.3\data\dhparam-ffdhe-4096.pem"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cc6c3d00e7931e92dfbb11c445fc4097

SHA1
7c9bafb59e1a68e23633d9a1dd4182798fbc1cad

SHA256
fcfed39864d15c59dd4fcdc89ae01d5580321008fff628ca5cca2ccce02314ab

SHA512
cac67e796ec2a232d2be8a51a9f739ab57f9c08eae7e3d04127ad719725635d7d57dcce7c88a9f430a4fec57f9e82cc6a536fac9109df225f404435b5db39030

Download Submit