Overview
overview
10Static
static
10R B X 1 2 5.rar
windows7-x64
5R B X 1 2 5.rar
windows10-2004-x64
3R B X 1 2 ...nt.exe
windows7-x64
1R B X 1 2 ...nt.exe
windows10-2004-x64
3R B X 1 2 ...or.exe
windows7-x64
7R B X 1 2 ...or.exe
windows10-2004-x64
10R B X 1 2 5/ai.cfg
windows7-x64
3R B X 1 2 5/ai.cfg
windows10-2004-x64
3R B X 1 2 ...rt.pem
windows7-x64
3R B X 1 2 ...rt.pem
windows10-2004-x64
3R B X 1 2 ...ig.vdf
windows7-x64
3R B X 1 2 ...ig.vdf
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15-08-2024 11:22
Behavioral task
behavioral1
Sample
R B X 1 2 5.rar
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
R B X 1 2 5.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
R B X 1 2 5/Client.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
R B X 1 2 5/Client.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
R B X 1 2 5/Roblox Executor.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
R B X 1 2 5/Roblox Executor.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
R B X 1 2 5/ai.cfg
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
R B X 1 2 5/ai.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
R B X 1 2 5/cacert.pem
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
R B X 1 2 5/cacert.pem
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
R B X 1 2 5/config.vdf
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
R B X 1 2 5/config.vdf
Resource
win10v2004-20240802-en
General
-
Target
R B X 1 2 5/cacert.pem
-
Size
2KB
-
MD5
39f89143815797c4a41c62f30f137094
-
SHA1
39a602c37ee958e5a5779c167ea095a56f0218e4
-
SHA256
5513aa54afe134569e08b27aa61e60e888ab31d9e112f8c5881adbaecc817678
-
SHA512
02cfee4a3fdc728e63e5a63797c58c5a6fbd805f6f6e5c0ab4e5dbf1d1701636a6aefc94095096b627b7475e731327d620c519ddc1a65b3ee49dd41b4d219d6d
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.pem rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.pem\ = "pem_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pem_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pem_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pem_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pem_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pem_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pem_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2924 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2924 AcroRd32.exe 2924 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2096 wrote to memory of 876 2096 cmd.exe 32 PID 2096 wrote to memory of 876 2096 cmd.exe 32 PID 2096 wrote to memory of 876 2096 cmd.exe 32 PID 876 wrote to memory of 2924 876 rundll32.exe 33 PID 876 wrote to memory of 2924 876 rundll32.exe 33 PID 876 wrote to memory of 2924 876 rundll32.exe 33 PID 876 wrote to memory of 2924 876 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\R B X 1 2 5\cacert.pem"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\R B X 1 2 5\cacert.pem2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\R B X 1 2 5\cacert.pem"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2924
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d8c718743fb0d0043c5d25d109391761
SHA137c6dc60d505d805cab84b2b3d72426a240ca29c
SHA2561c93d7668b4e86674a07887d28985434df4fdc752d58849ba6b5fd6166bfe3fc
SHA5126a33a71da3b2699dead8fe176d7bc8afcc23ee5cae0c05f35366ed462139c26eea8838771ad8343b6f090a57ace9f73b16c4b23e8bcf323c83b80add7f24a450