c61b5607b44767ddefc0bffe8defe80e632309d82196b335bfd7f30dd59fd165

Analysis

max time kernel
103s
max time network
26s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Megpoid_sweet/setup.bin
Size

152.1MB
MD5

c4af4bb5f1fadde8de2d36ac4d9e4d1a
SHA1

9b8b7551aa7d9697bd8a285a194762d154d91269
SHA256

5983328323db0f4d5f2a49780c599ac98a1e95c9f4da22092f63e4c86e12da5e
SHA512

281a1bb3e72000928dcd06cc1206b6689d5034c72c7632c96558171c43351659cc88dd7902b37cf288658a87049089cfd69a7cb1539593126fed48ac2bfcf2cb
SSDEEP

3145728:dki9Dn0DSbS0V2pbdDTlqH3ZLhMwdghXNQk81lfMXQ:2ihaS+0VsbdHSZLh3duSVZ6Q

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\bin_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\bin_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.bin\ = "bin_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\bin_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\bin_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\bin_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.bin	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2784	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2784	AcroRd32.exe
2784	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2296	2364	cmd.exe	30
PID 2364 wrote to memory of 2296	2364	cmd.exe	30
PID 2364 wrote to memory of 2296	2364	cmd.exe	30
PID 2296 wrote to memory of 2784	2296	rundll32.exe	31
PID 2296 wrote to memory of 2784	2296	rundll32.exe	31
PID 2296 wrote to memory of 2784	2296	rundll32.exe	31
PID 2296 wrote to memory of 2784	2296	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Megpoid_sweet\setup.bin
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Megpoid_sweet\setup.bin
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Megpoid_sweet\setup.bin"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ac678ed8ee1954f8d6030346c78cdf37

SHA1
4ef20cf223a71b7510d712e6d9ee29f628710e6d

SHA256
5499d5602617fc9f045680c1ac7ca6b0e501a905d618996ea9396fcfb75bbfed

SHA512
c5b4199e91662eadf83a85c76340a3efcb17c69069f9decbbd220acef30db6d4b93b0b74735c0abb5374ad50cfdd001a45a5cefe48809446fb89e432a4918aef

Download Submit