a759f450c9f1e6815b3dccd0ffd77e183794334eaf60ba77fb0cd7e5a7d7fdda

Resubmissions

07-08-2024 12:20

240807-ph2rtsyejj 10

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
07-08-2024 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$APPDATA/TotalAV/updates/SAVAPI 8.0.1/aeexp_gwf.dat
Size

59KB
MD5

d68dbed2d9e81bb670e94b0b550cccdf
SHA1

edebaf42b7b772274ffbdf070d965aa585cb14f4
SHA256

2d7925f16b1b835b7265d1c04c38c599f2b25c5087a0005dec60dcd22e9f3dd7
SHA512

162c6078492870fb1712968e5cf81e99b0e16dc2c737eb56f5dac1e17a66457382d555faf2ae9096b5e0103cf79e79c629007ca2ccb80d422e424fefe3a6c734
SSDEEP

1536:lalK69DzGxZ+w0R++MOp3lH3iEZdmD4QKdTZ8bEnicyhgAj:IoGDixZ+n4+Ma1yIPQOZV9e

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\dat_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.dat\ = "dat_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\dat_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\dat_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\dat_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.dat	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\dat_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2664	AcroRd32.exe
2664	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2244	1576	cmd.exe	32
PID 1576 wrote to memory of 2244	1576	cmd.exe	32
PID 1576 wrote to memory of 2244	1576	cmd.exe	32
PID 2244 wrote to memory of 2664	2244	rundll32.exe	33
PID 2244 wrote to memory of 2664	2244	rundll32.exe	33
PID 2244 wrote to memory of 2664	2244	rundll32.exe	33
PID 2244 wrote to memory of 2664	2244	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.1\aeexp_gwf.dat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.1\aeexp_gwf.dat
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.1\aeexp_gwf.dat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c48281652c58b9be21902f13cbf6d6ec

SHA1
5bb4150ab85ac5c7b29e239432c70cd9c119186f

SHA256
855d14d712f6c11de0cc4fc6b0ca3ee9a31d316441deb2b1b644ddecb709fd1c

SHA512
4c01650c312dbdc6a0f5f6c307d84352b3ecbbacdcda8d16496cfe45df2c351f49ec95229383d0ffef9753a110ef0af5edf74fc332cc9d38b8a3ff56d8fc9f5d

Download Submit