31a41571e3cf39f65893a8a6d97da7d846114dce12adeb158fd013548f1cc18f

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 05:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SolaraB2/SolaraB2/Solara/workspace/IY_FE.iy
Size

971B
MD5

059dd36a7e96d6060762b18d2bf13864
SHA1

038bfd6bdde0350b3c5b03701e8cdbdc92a3ff6c
SHA256

427eecaf21ec588e89d8449a8f7ba160550ae46b7316542cd1d595e1671fa632
SHA512

f3d9ab8e6601c7245879cb8b3502d81b7bc77c51be947b11ad129d4191b03e4206e2845e487dd9b0e3f265e1699b860ef11e34b2983b7bb880fbac8a077c4ebe

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.iy	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\iy_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\iy_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\iy_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\iy_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\iy_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.iy\ = "iy_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\iy_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1608	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1608	AcroRd32.exe
1608	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2784	2200	cmd.exe	31
PID 2200 wrote to memory of 2784	2200	cmd.exe	31
PID 2200 wrote to memory of 2784	2200	cmd.exe	31
PID 2784 wrote to memory of 1608	2784	rundll32.exe	32
PID 2784 wrote to memory of 1608	2784	rundll32.exe	32
PID 2784 wrote to memory of 1608	2784	rundll32.exe	32
PID 2784 wrote to memory of 1608	2784	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SolaraB2\SolaraB2\Solara\workspace\IY_FE.iy
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SolaraB2\SolaraB2\Solara\workspace\IY_FE.iy
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SolaraB2\SolaraB2\Solara\workspace\IY_FE.iy"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a4f1604d33fdfff12ede6ce2cd7f5d8d

SHA1
a84e684f38d3b4fef856caf793136a02453b91e8

SHA256
dd74a6830b0b99841d36ea86540600432b48c23eac5d31bc0f21ea2075ed740f

SHA512
f735934f3ca971c1ab364060dc27fea4ef075331016e0aa8a3b6322c2111f6352e46106ec77db65238d561d36f8f0fba129f3571c25ce9e2e715e9ace406bd8b

Download Submit