4bdfa8e89d95d1ecedd2b2793d8b21c0f71c8183adc10b469bd4032d461fcf75

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.tar
Size

9.7MB
MD5

a8e5f9e3ffdbd8e8f4dddb861cbff794
SHA1

4b7667ca1653519f5c5898dc5766bb118100ff55
SHA256

e70487065bf1017f4b09fd68a1032222e5066b0d2191059c962fff55b8cf89e3
SHA512

04fe8f420d47887cda70976dd216446a5fde157d3e0eb1fc56ad5f535a76dc5d13e992e547939cb603ea94608f4b2d9eb2f94893f479380041bbdb51ee5186fe
SSDEEP

196608:OxwLjt17fTacw4R8IY6NFJh1yw93pbBDlIkhvy9i:OxwLjt17fTacw4R8IY6NFJh1yw93pbB

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2628	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2628	AcroRd32.exe
2628	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2520	2300	cmd.exe	31
PID 2300 wrote to memory of 2520	2300	cmd.exe	31
PID 2300 wrote to memory of 2520	2300	cmd.exe	31
PID 2520 wrote to memory of 1860	2520	rundll32.exe	32
PID 2520 wrote to memory of 1860	2520	rundll32.exe	32
PID 2520 wrote to memory of 1860	2520	rundll32.exe	32
PID 1860 wrote to memory of 2628	1860	rundll32.exe	35
PID 1860 wrote to memory of 2628	1860	rundll32.exe	35
PID 1860 wrote to memory of 2628	1860	rundll32.exe	35
PID 1860 wrote to memory of 2628	1860	rundll32.exe	35

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample.tar
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\sample.tar
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\sample.tar
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\sample.tar"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
aca6de390e6cba471bc7661f8a71ae6f

SHA1
8dbc8225e92ccd9c17f198f397ec41b94d92d0c2

SHA256
e56f52d660e06b220ad15b6b50c8a690230e25c0f9e186a0c49a0bafcbbe3c55

SHA512
1f67520c32165cbf4178df23873c35c761103c82655a1a9ebc19560761ef620d2a758cb37153d1b9088739889b1023dc5611a4388cd1e12f0061aa4e2cef74d4

Download Submit