8187eb54b87190f0216bc0c7fa6b1607ad6d957e01281e84cc1a3ec27b38757c

Resubmissions

10-08-2024 11:37

240810-nre4raxekr 10

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-08-2024 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mw3/Database/AppRate.dbd
Size

488KB
MD5

35e6f62ca4d0462ca3cbf542018b051c
SHA1

2cd62ef4b83421f192dd32eefd8a1156afe7923c
SHA256

5bbdefea5009668d43677417772cf9f72c7ab48fb74fb8a65ccc9bec01e7fa25
SHA512

4356e9b8f61527bf6c0d844b9ea9ff6d2b1d90c43c1392c3ae9f164ab8e966bade281d5dca6dfb6cfc27f0603959f39a5ec967cf819743e1e521b23df5e7ef4b
SSDEEP

12288:+U0m/aILw9m1KMdHLMz446fcaTUawBhkeYrJDzqGqn5r:Daaw9m1NlHKnPBhkvJD+Jr

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.dbd	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.dbd\ = "dbd_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\dbd_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\dbd_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\dbd_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\dbd_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\dbd_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\dbd_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2808	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2808	AcroRd32.exe
2808	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2644	1904	cmd.exe	32
PID 1904 wrote to memory of 2644	1904	cmd.exe	32
PID 1904 wrote to memory of 2644	1904	cmd.exe	32
PID 2644 wrote to memory of 2808	2644	rundll32.exe	33
PID 2644 wrote to memory of 2808	2644	rundll32.exe	33
PID 2644 wrote to memory of 2808	2644	rundll32.exe	33
PID 2644 wrote to memory of 2808	2644	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mw3\Database\AppRate.dbd
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\mw3\Database\AppRate.dbd
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\mw3\Database\AppRate.dbd"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bd25cf677dfcbb253d47e9c22c780c0f

SHA1
b42f146837ffd219780b2bfc0aa7d6fa85105ecb

SHA256
c0f1ab33847e94dc7ece1e340d63912036997a5eb70a27c6ae17dd9a3b87d65f

SHA512
62f80b7a8aab1ffd93227473ed4fc196caf92a1eebe17e738e6c401725eaf9be6d6b09f45509aab9711550d892d9ac018844906a578546eafc81b0db32c5792a

Download Submit