a97caeea5750215ce3f795d9e309e43ae4afa66ca3092e172ce66688996f0b29

Analysis

max time kernel
102s
max time network
48s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data/OFFLINE/5EC33410/12CA213D/Doppel-Filter Factory.ngrc
Size

56KB
MD5

5ce18c7bbe5008577eae4354aa833925
SHA1

8945e9313402522926944409c0204faffa9061b7
SHA256

02347795bf5af9bc4327304870158b504ba05c58c344586ed1486e958f9de7b9
SHA512

216ac50901242f3ac117d6649ff1d2bb2ee186a9e2d5308db3fd66eca4e75c2ed72f17b16ce747f33afde77fec034688776aaa4f28d20e47f9790d4e62800a09
SSDEEP

384:+xZ9R411hng5WYwVHOjUVyHIeRODFKZHIOYAvd0weCFYf9y4GFfZpND5m4/yCuFM:+vd

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\ngrc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\ngrc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.ngrc\ = "ngrc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\ngrc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.ngrc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\ngrc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\ngrc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\ngrc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2744	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2744	AcroRd32.exe
2744	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2860	2944	cmd.exe	32
PID 2944 wrote to memory of 2860	2944	cmd.exe	32
PID 2944 wrote to memory of 2860	2944	cmd.exe	32
PID 2860 wrote to memory of 2744	2860	rundll32.exe	33
PID 2860 wrote to memory of 2744	2860	rundll32.exe	33
PID 2860 wrote to memory of 2744	2860	rundll32.exe	33
PID 2860 wrote to memory of 2744	2860	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\data\OFFLINE\5EC33410\12CA213D\Doppel-Filter Factory.ngrc"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\data\OFFLINE\5EC33410\12CA213D\Doppel-Filter Factory.ngrc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\data\OFFLINE\5EC33410\12CA213D\Doppel-Filter Factory.ngrc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
332880457ad0700c36def84365382cf7

SHA1
4314879064f5164ac236a5cc4a9dee8264f08b8d

SHA256
98d95d5fbec2d003f7c23f48d8a21ebd13420622214d77e5158b65786227191a

SHA512
339ceff2791caf41ecd7d2b8ddd9a5c45fcc89839bae2cb528c642c08e1bea1cd2c000554ac74f97fad3ec6eb8b500c412b1a4c52628ecd43f6006fad3fb9614

Download Submit