bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552

Analysis

max time kernel
102s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

__MACOSX/._medicaresign
Size

276B
MD5

d16decad95607c5def284c3e7bd17523
SHA1

498544433a1128df9a850431971403945e42d139
SHA256

c2f4d1605bde8982981ca84e8f0369057d4a32b0b97dda128b5011fdc57ed55e
SHA512

5cab48c3cd05a9d68aaf6a64cc484d08250cf8ebea715aa9188ef9adf2740f0974c889b4f0776f845299944cbab55dd26520338505cfcc07529ec9982436ef8a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\_medicaresign_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\_medicaresign_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\._medicaresign	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\._medicaresign\ = "_medicaresign_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\_medicaresign_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\_medicaresign_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\_medicaresign_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\_medicaresign_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2604	AcroRd32.exe
2604	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 2920	600	cmd.exe	31
PID 600 wrote to memory of 2920	600	cmd.exe	31
PID 600 wrote to memory of 2920	600	cmd.exe	31
PID 2920 wrote to memory of 2604	2920	rundll32.exe	32
PID 2920 wrote to memory of 2604	2920	rundll32.exe	32
PID 2920 wrote to memory of 2604	2920	rundll32.exe	32
PID 2920 wrote to memory of 2604	2920	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\__MACOSX\._medicaresign
1⤵
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\__MACOSX\._medicaresign
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\__MACOSX\._medicaresign"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d33f07aef1c07c7f83715530955d897f

SHA1
a0d7d4f8eed3fa8573bf737d8dd2ebcb000343ad

SHA256
43ae5c93ff8092008641dadeee46c04f6bdb89d4cf8c200f9813f9729430c2fc

SHA512
4520af4b8cc9227a3a83e74b5d0cb5a36a29ea2e82a94d367ca5f8871be30d840d04bf972a400f39256758c014d332679f20a7c71cfe9f445a57ce8727ed1acb

Download Submit