8187eb54b87190f0216bc0c7fa6b1607ad6d957e01281e84cc1a3ec27b38757c

Resubmissions

10-08-2024 11:37

240810-nre4raxekr 10

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10-08-2024 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mw3/Database/FB.dbd
Size

1KB
MD5

7658e57a9edaad654541d85395631273
SHA1

e3ab41cddd16542df3be0fa653c846af92ef63e0
SHA256

3959f201a225f64df25cf1098ebb2ddbc6b16654fb4bebd97a8c764e13e134c6
SHA512

b4d040e41eae7eeb0dc6c382ae61c6737c9242636829e61a044eb9abd297791ef4f606623301ef02feebe753ac4994a10a4f21c66a327dc70c014d4f2faec58d

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\dbd_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\dbd_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\dbd_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\dbd_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\dbd_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.dbd	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.dbd\ = "dbd_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\dbd_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2724	2584	cmd.exe	31
PID 2584 wrote to memory of 2724	2584	cmd.exe	31
PID 2584 wrote to memory of 2724	2584	cmd.exe	31
PID 2724 wrote to memory of 2720	2724	rundll32.exe	32
PID 2724 wrote to memory of 2720	2724	rundll32.exe	32
PID 2724 wrote to memory of 2720	2724	rundll32.exe	32
PID 2724 wrote to memory of 2720	2724	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mw3\Database\FB.dbd
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\mw3\Database\FB.dbd
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\mw3\Database\FB.dbd"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
27c2b465d8dc094027e91f050a2cfe4d

SHA1
e7e8ea6a908f76cb0676e18260bc745b0fbc87dc

SHA256
53ae79587e7efa80bdfd28efee44382b4c0eefba3c66bcead452c0a7333df393

SHA512
588a31de944f8fcdc2be3426ac210d2343bd94f0e42a11e79ee1088362f22ca8789473561ea8e44c3c87fa26241b0ccdbebca73579667843aa30cdc96d287369

Download Submit