41f8177b4b441a17e91bdcb6f4d95cc0673cf8e71ee522f30cf5e4a44e28b0fe

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/A2451303/x1010109.7z
Size

226KB
MD5

2ece60cb284456cd0a454af87ffd9a1d
SHA1

09ab2a5730cd11814ac58eccb498df2f081cd4ca
SHA256

d4f56c1ff0aced689962630b157b3cb521f1ea3ead67240be77fbeddab1236c3
SHA512

59d4c5a6fbea36d76ff17ef52de0193d430b9efdf674f36493794ec92f825ab82f75a21448999d10453cee197855c20046f9370c5fc5da83d0654ddaadde3c26
SSDEEP

3072:ynHYXkr5HGhqYS/nOTQx4FbsxP8MlI9Q+lVxjC11/NrM3BmQrOo:LU5EqFnOsx4F+emQh

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1592	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1592	AcroRd32.exe
1592	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2616	2312	cmd.exe	31
PID 2312 wrote to memory of 2616	2312	cmd.exe	31
PID 2312 wrote to memory of 2616	2312	cmd.exe	31
PID 2616 wrote to memory of 2804	2616	rundll32.exe	32
PID 2616 wrote to memory of 2804	2616	rundll32.exe	32
PID 2616 wrote to memory of 2804	2616	rundll32.exe	32
PID 2804 wrote to memory of 1592	2804	rundll32.exe	34
PID 2804 wrote to memory of 1592	2804	rundll32.exe	34
PID 2804 wrote to memory of 1592	2804	rundll32.exe	34
PID 2804 wrote to memory of 1592	2804	rundll32.exe	34

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\A2451303\x1010109.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$TEMP\A2451303\x1010109.7z
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$TEMP\A2451303\x1010109.7z
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$TEMP\A2451303\x1010109.7z"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d2cc9d81b57f428048ff2080e30a9202

SHA1
a31e651901e00ad5c99f362dbe292ab93d77bab6

SHA256
50b9fc1e5ef8e7506c96788978d3b42dc761dbd1a5e040942b8a03f4432c9130

SHA512
62bd495413ee27e5f1ab96d5a4da0f60ea8add168dde2f9948e61a23498bb8c19024b5914b96e81d7ec100d134f8ff76e2340ebf0f20264dff6a5bfaa9f0e016

Download Submit