a97caeea5750215ce3f795d9e309e43ae4afa66ca3092e172ce66688996f0b29

Analysis

max time kernel
102s
max time network
38s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data/OFFLINE/5EC33410/152BC712/Matched Cabinet Factory.ngrc
Size

32KB
MD5

2ea2632793389a2274cc2d3c886c297f
SHA1

7322c8a5e49b29b3b74d9cb932bbe8cdbf95223b
SHA256

823a2e24e3499d9419d9be7232fe29905db1b70bfdcc4a432ae28ded41dae1db
SHA512

5418fc5d747c175360772102558d608a99650b9145eab182832eebff20ce289b7119c28b5fb8e4568fc27daac87729dbd57663acc5effc39f5edba46a0f26e76
SSDEEP

192:6ssjNBbvE7GKSGwlVq66FMraDmrSUNI2KoCSQ+1:KNBTEjSlLqFFqCmrSF2KoCSQ+1

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ngrc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ngrc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.ngrc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.ngrc\ = "ngrc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ngrc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ngrc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ngrc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\ngrc_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2932	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2932	AcroRd32.exe
2932	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2712	1496	cmd.exe	32
PID 1496 wrote to memory of 2712	1496	cmd.exe	32
PID 1496 wrote to memory of 2712	1496	cmd.exe	32
PID 2712 wrote to memory of 2932	2712	rundll32.exe	33
PID 2712 wrote to memory of 2932	2712	rundll32.exe	33
PID 2712 wrote to memory of 2932	2712	rundll32.exe	33
PID 2712 wrote to memory of 2932	2712	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\data\OFFLINE\5EC33410\152BC712\Matched Cabinet Factory.ngrc"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\data\OFFLINE\5EC33410\152BC712\Matched Cabinet Factory.ngrc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\data\OFFLINE\5EC33410\152BC712\Matched Cabinet Factory.ngrc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
091fa638ddc5d8e00f707bcfdedc459f

SHA1
c18c4a635b64875888b95597280944b302ad080e

SHA256
e164aba4357278a56e9baf82fa6a55f4bfcd2abf6a72d2bf0f258fca2f57917f

SHA512
cd2658b0675a1c94861f48615b8fd60109bcb576c1ae8a898e56732b0fff1b3c2da7e6c614fa98e199ff7f6d2d5b8b0c65e098d8d13a0be296a7ea0bb472c79e

Download Submit