76afbad7304f66738d4f26200c7c1eb410a70b0e9a051794d93f836ced3fa387

Analysis

max time kernel
102s
max time network
19s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bibliotherapy.mul52
Size 149KB
Sample240715-jmrjrswamn
SHA256 d476d200f8699be3d81c77976dda83f012ecc6cb1af431f67d11759d51985570
MD5 42aa056e2dd468d44c09d3ba9d637496
SHA1 f8bec4986bd2cfdc23ef4fc228ffb396c09a270a
SHA512 fc6aa342fbbb609bf1f4aa113e50c4bab6fba451509e05b02926241e4ce767376cc4302a239a0067661075bfddf185812fd1426dd28b047a58e9e578308df58c
SSDEEP 3072:+rm1j7CgccBaLU3y0pCRGCfDRAPFJKp6XpYK9V+ZXCN:+iR7CmBIGyECRGaRAn/qKqUN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\.mul52\ = "mul52_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\mul52_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\mul52_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\mul52_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\mul52_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\.mul52	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\mul52_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\mul52_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2740	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2740	AcroRd32.exe
2740	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2784	2084	cmd.exe	30
PID 2084 wrote to memory of 2784	2084	cmd.exe	30
PID 2084 wrote to memory of 2784	2084	cmd.exe	30
PID 2784 wrote to memory of 2740	2784	rundll32.exe	31
PID 2784 wrote to memory of 2740	2784	rundll32.exe	31
PID 2784 wrote to memory of 2740	2784	rundll32.exe	31
PID 2784 wrote to memory of 2740	2784	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Bibliotherapy.mul52
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Bibliotherapy.mul52
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Bibliotherapy.mul52"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 fa039caf069d952c66787909dc6a1ebc93b2b1741872724b3f0dc2ef1bba09d1
MD5 97760de10cc6554e29bf22de5714d68e
SHA1 1d7522e9592fdf188921d5aaed6ba7cd7f0c6f25
SHA512 eb7f2bb133e6b7154fc88201903b7236c6950c27e2998ed8cc94d6cfa6e96e2939ca700bdfdde0e9892fec3c01ae740555cb255ef34816f94278cad066f44404
MD5 SHA1 SHA512

Submit Download