66b13fad78119e5cfb1933fba5effb8f2dbeae76bbdf21868b5ab2167567be80

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AG.class
Size

1KB
MD5

f58268a9935bebfcdf9a7dfd92fd3d47
SHA1

8d53bb8114a2a27d94f2aec7c9e8df05f5aea4ec
SHA256

7e692644d10258cbd7e93a010432fc92a147a65a69b9770304d26b07f8611648
SHA512

ccbf22911c95dc6f1072ada176596018809f6e793376b543d79127eb9adbcc0aee85a72c5a39576ff8783ba6a5737dbff4fb479bfd759784e9bdf06f6d7af181

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\class_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\class_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.class	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\class_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2824	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2824	AcroRd32.exe
2824	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 2396	1604	cmd.exe	31
PID 1604 wrote to memory of 2396	1604	cmd.exe	31
PID 1604 wrote to memory of 2396	1604	cmd.exe	31
PID 2396 wrote to memory of 2824	2396	rundll32.exe	32
PID 2396 wrote to memory of 2824	2396	rundll32.exe	32
PID 2396 wrote to memory of 2824	2396	rundll32.exe	32
PID 2396 wrote to memory of 2824	2396	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AG.class
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AG.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AG.class"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7dff3736a13e41ffd8e01c158d23d05a

SHA1
218e9888c29da4bd22966098902b616a041531dd

SHA256
7b4145c931a02fbeb84df387cd3085515cc5f04af34cbeb72da63239c9290f42

SHA512
774043b13a120f527809b00054096148f356a303aae96b94a7c9937e45fb9f78b14d1a7fea09e520861bdee6eb865d8f0ee81b2eb55442cbeb4a55cfdf61426e

Download Submit