128fc5191ada9b75184152b025236023e1f36eb72d4e172b41a296c108cf6f3e

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

by Vitruv_/data/scoreboard.gz
Size

682B
MD5

b4f003414207429b71098c44a618497b
SHA1

ecce47e1513c77b540b2744d63435d08e788709a
SHA256

ec074c8afcffdc4bc66a9084108a24952879897dc9f761021e394d6dfae86886
SHA512

129de2c82409dbc3180b96979325799de967389049c3892f0d156b0c8385a836a08b010eb87cdbf216c4ec7ff03adc5dee54edaf3c4db6c05519dd4c007bc416

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
664	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
664	AcroRd32.exe
664	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2720	1964	cmd.exe	31
PID 1964 wrote to memory of 2720	1964	cmd.exe	31
PID 1964 wrote to memory of 2720	1964	cmd.exe	31
PID 2720 wrote to memory of 536	2720	rundll32.exe	33
PID 2720 wrote to memory of 536	2720	rundll32.exe	33
PID 2720 wrote to memory of 536	2720	rundll32.exe	33
PID 536 wrote to memory of 664	536	rundll32.exe	35
PID 536 wrote to memory of 664	536	rundll32.exe	35
PID 536 wrote to memory of 664	536	rundll32.exe	35
PID 536 wrote to memory of 664	536	rundll32.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\by Vitruv_\data\scoreboard.gz"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\by Vitruv_\data\scoreboard.gz
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\by Vitruv_\data\scoreboard.gz
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\by Vitruv_\data\scoreboard.gz"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8673c3418e70fd04419ed1b219c5b437

SHA1
f804864659bafb9783dea3429f6797f7718fe712

SHA256
40c12e86decb15f0ba6d63e8b6b022cfab8ec66c40b45af70b43df61e920bf34

SHA512
c91040c729b45ce770e517b8e7c888dc4b55f8513732370c9e3ca85549407f1fad1064aafef6303ccbcf75b8a0bd4af4a3491f429176435a94a586ff396ad2b5

Download Submit