922761f877f00298bb78d905c172580670fa399156f7ed9a945377d6977ec848

Analysis

max time kernel
34s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

v3.0
Size

171KB
MD5

7f5f9e4fb52a48fec61aa1395da229e5
SHA1

37448d6369e4b63c8682e9d96b1747d5f35dfde6
SHA256

922761f877f00298bb78d905c172580670fa399156f7ed9a945377d6977ec848
SHA512

72865f1b18f80fc5325ecd0b13e4a29efa27d5a40ba92be902f8bb1db3a58543ca1d87ab684ec0822c35e334609a6975aff7b1333e93e920c20e2089b07c2cf7
SSDEEP

3072:tbIxwVwhS1lhL26yOPP/X6OOKeR7+Cms1YElWGaFh2OF91P6eY1ytHhAI4oZ91Pf:aFnoodvSOKMQpf8j7Ley1682rmY4z9fq

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.0	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.0\ = "0_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\0_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\0_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\0_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\0_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\0_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\0_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2876	AcroRd32.exe
2876	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2816	2576	cmd.exe	31
PID 2576 wrote to memory of 2816	2576	cmd.exe	31
PID 2576 wrote to memory of 2816	2576	cmd.exe	31
PID 2816 wrote to memory of 2876	2816	rundll32.exe	32
PID 2816 wrote to memory of 2876	2816	rundll32.exe	32
PID 2816 wrote to memory of 2876	2816	rundll32.exe	32
PID 2816 wrote to memory of 2876	2816	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\v3.0
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\v3.0
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\v3.0"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
95b903a88e5d414edd15a0492fbc6f26

SHA1
86aad138dde02d27b274001224b5ba988128b049

SHA256
eb2579825ad3a6bd8c630323267166a5ab1499b958e14101e737825fcf89fc5e

SHA512
10d403542ba91aef6872355246d76f6d7788952622454036029fc0566bf1d30c4886a7afa7bac0fc7f1318538a290a87ec1a1b1f56483d49b8022475accef246

Download Submit