3d597b0edd887a7a169451ac87a434253f69db41dda24ed05a41cfeeb4861b7b

Resubmissions

12/08/2024, 06:02

240812-grwm6ssfqc 7

12/08/2024, 05:19

240812-fz37jsxbqk 7

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/sharedassets14.assets
Size

7KB
MD5

279f017875d0c8d0e8a223c15d50271b
SHA1

2864a08bfcca546b693c278810eebf7a7c512e5e
SHA256

0a40b66cfc384fd6c9b435af294f8b6f6a2848bce0cfdb661ae91e0b1aedf004
SHA512

c8ac2b17ba33673cf6d10d928146a7c396270460134f3b709fbc29cefa5689278596566ff30b5936ce411e78cb9c51f7998c4be492c266b93ea298f504ac0c33
SSDEEP

48:nyvZMCye0c4jrlmSO7HqzvZ+j1+NOndR4h8:yvyeCjwRKliQNb

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.assets\ = "assets_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\assets_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\assets_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.assets	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\assets_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\assets_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\assets_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\assets_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2600	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2600	AcroRd32.exe
2600	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2708	2360	cmd.exe	31
PID 2360 wrote to memory of 2708	2360	cmd.exe	31
PID 2360 wrote to memory of 2708	2360	cmd.exe	31
PID 2708 wrote to memory of 2600	2708	rundll32.exe	32
PID 2708 wrote to memory of 2600	2708	rundll32.exe	32
PID 2708 wrote to memory of 2600	2708	rundll32.exe	32
PID 2708 wrote to memory of 2600	2708	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Heaven.Will.Be.Mine\Heaven Will Be Mine\HeavenWillBeMine_Data\sharedassets14.assets"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Heaven.Will.Be.Mine\Heaven Will Be Mine\HeavenWillBeMine_Data\sharedassets14.assets
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Heaven.Will.Be.Mine\Heaven Will Be Mine\HeavenWillBeMine_Data\sharedassets14.assets"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
28b5938bbf7b07cf7305f9925b5324fa

SHA1
06726ff4776ab25621355816e51def247ecdadee

SHA256
3b8db827b68998f1636ea4d2b9acac8806bcfbf6bd9adf142e019aabe5fe03de

SHA512
55a97753bc0c8fb168509090d4c981aa29f718c4ec50f7f6876d134ebe463eb6a5c81130015b4bc8f1b17d6a009d865b22ea80299b3fe15b9408e9290b54287c

Download Submit