66b13fad78119e5cfb1933fba5effb8f2dbeae76bbdf21868b5ab2167567be80

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AL.class
Size

306B
MD5

d81ac9c31241c16bccfc5f196f0e9aca
SHA1

7dabdd2f46c55cbb79d1f432a7c9e12401ce5bf7
SHA256

5717ed3e0ff62bc5f66c2354159f86e00cd93620ce2b6bcfd6c373f1105f2694
SHA512

0403a589116a5fd2a9adae47f527777f9e666ef53029dd0c34d50b7cdd20e1d973237f4a4f85ba28d29764684dd8b695a5ea50a5c85afc26da615d822c34f61f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\class_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\class_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\class_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.class	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2784	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2784	AcroRd32.exe
2784	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 2384	780	cmd.exe	32
PID 780 wrote to memory of 2384	780	cmd.exe	32
PID 780 wrote to memory of 2384	780	cmd.exe	32
PID 2384 wrote to memory of 2784	2384	rundll32.exe	33
PID 2384 wrote to memory of 2784	2384	rundll32.exe	33
PID 2384 wrote to memory of 2784	2384	rundll32.exe	33
PID 2384 wrote to memory of 2784	2384	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AL.class
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AL.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AL.class"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8187e0abd8d2a646e9e93d3324b310fc

SHA1
01575aea57b44b5a528345f44d1384b16f692a44

SHA256
d2af0ee383bfbca8b0f06cdd04a805850487a163470aa5f25a60aacc2462c9d8

SHA512
9d22a8eea1b9999bb659dfc86398d2b86eada48ef26018b13165ea353ef5167bc02b7d17eec9eae1d92c5ee8e1dbb07354a3f165b25177b392c7cd84368ab16b

Download Submit