66b13fad78119e5cfb1933fba5effb8f2dbeae76bbdf21868b5ab2167567be80

Analysis

max time kernel
125s
max time network
137s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AE.class
Size

1KB
MD5

bfe76297d3a0341c9ae45a2fb03d5aa8
SHA1

39ff5a74711d03ae5cccccdd9346898db90bbfcd
SHA256

d9ee9abd7c16d5a625f513b01098b983e6da4b622b50f67fad2c598a64495119
SHA512

88e03e8d3f9e7fdca546afadbdac0149ced14cc410f06e67781fe48634c6da2fede3cb8a07b3ab2dc915590d745c390a6e4a1027d750825a85a6f54229dee07a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\class_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\class_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\class_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.class	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2644	AcroRd32.exe
2644	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2640	2444	cmd.exe	31
PID 2444 wrote to memory of 2640	2444	cmd.exe	31
PID 2444 wrote to memory of 2640	2444	cmd.exe	31
PID 2640 wrote to memory of 2644	2640	rundll32.exe	32
PID 2640 wrote to memory of 2644	2640	rundll32.exe	32
PID 2640 wrote to memory of 2644	2640	rundll32.exe	32
PID 2640 wrote to memory of 2644	2640	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AE.class
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AE.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AE.class"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
907cb1efad7c26a66b7eccdb43228b76

SHA1
70a6fc581d5c269e830bfc2665e7d2ab3ea18dbe

SHA256
4c765709e11ecf1e37f49ee65e36dc1c0d46c0d03524f8e63a6dcc1749c2e97a

SHA512
96942b10b78a4601a2aa89b24e6d15f0747b31de995d1597dbf3965879118bdcb0df313cfcd71d5129706872a3c27d8c99a84d82dfa721252f628b2dc801db15

Download Submit