Overview
overview
10Static
static
100.exe.zip
windows7-x64
10.exe.zip
windows10-2004-x64
10.exe
windows7-x64
100.exe
windows10-2004-x64
10.data
windows7-x64
3.data
windows10-2004-x64
3.rdata
windows7-x64
3.rdata
windows10-2004-x64
3.reloc
windows7-x64
3.reloc
windows10-2004-x64
3.rsrc/BITMAP/103.bmp
windows7-x64
3.rsrc/BITMAP/103.bmp
windows10-2004-x64
7.rsrc/MANIFEST/1.xml
windows7-x64
3.rsrc/MANIFEST/1.xml
windows10-2004-x64
1.rsrc/MENU/102
windows7-x64
1.rsrc/MENU/102
windows10-2004-x64
1.rsrc/version.txt
windows7-x64
1.rsrc/version.txt
windows10-2004-x64
1.text
windows7-x64
3.text
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15-08-2024 09:26
Behavioral task
behavioral1
Sample
0.exe.zip
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0.exe.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
0.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
.data
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
.data
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
.rdata
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
.rdata
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
.reloc
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
.reloc
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
.rsrc/BITMAP/103.bmp
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
.rsrc/BITMAP/103.bmp
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
.rsrc/MANIFEST/1.xml
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
.rsrc/MANIFEST/1.xml
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
.rsrc/MENU/102
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
.rsrc/MENU/102
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
.rsrc/version.txt
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
.rsrc/version.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
.text
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
.text
Resource
win10v2004-20240802-en
General
-
Target
.rdata
-
Size
7KB
-
MD5
c15aa553db9a4966096910f155c0cb03
-
SHA1
d878b158a08acd424e2d9aec90e206f08c1e72a8
-
SHA256
5d9abcefc38a9cacdf88d466fccf68040f4a8aef5bac04988b23eab1877304ea
-
SHA512
d6ae643cf73637947a43f5cdff3b798f001a684c014acce155e0e332c26c68fcead6b4e67b7acb4b542a56a6c2784ff9930c2076ac8f3a5263002595b6e670d5
-
SSDEEP
192:gtlg8q/6gE+tlbr6okz1hDAWSGiRuCDW94Ny:M+Pi/Opr6jzLbSPS9yy
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\rdata_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\rdata_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.rdata rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\rdata_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\rdata_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\rdata_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.rdata\ = "rdata_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\rdata_auto_file\shell\Read rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2836 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2836 AcroRd32.exe 2836 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2180 wrote to memory of 2660 2180 cmd.exe rundll32.exe PID 2180 wrote to memory of 2660 2180 cmd.exe rundll32.exe PID 2180 wrote to memory of 2660 2180 cmd.exe rundll32.exe PID 2660 wrote to memory of 2836 2660 rundll32.exe AcroRd32.exe PID 2660 wrote to memory of 2836 2660 rundll32.exe AcroRd32.exe PID 2660 wrote to memory of 2836 2660 rundll32.exe AcroRd32.exe PID 2660 wrote to memory of 2836 2660 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\.rdata1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\.rdata2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\.rdata"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD554d87dec7423f5ee072e5a10748839f1
SHA1c030fae87e1cba51131bb56ff22d1df316332c5a
SHA2565efa825b38bf8efc1cded0c8fa9511273333523b8170694027dfb4cbc5266f86
SHA512d95ae91feea8f35e8d6d046616f8318ea4103e63938fc613a84c39473bbe8d33d54b8e5ce0e66d36cc3299d57041d425a665fe3c518208210350c0a4c8a1ac7c