177c0d44829888987f89988f21973d8364853a864103d5bda9269e2b82e4bc37

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zeus-translation/temp/server/php/stats_main.lng.en.php
Size

978B
MD5

a15f315569ed8227d0855c62194fac63
SHA1

aacf2bc406ae54761f43dc51847b1b96a87970ea
SHA256

fc674619b42fb2c3642406b7f0eaa6d793f2630c1703fced2b6b17abab28f27a
SHA512

e8ae326f1f3204268352e523bc3aa648eb54048ef98cdb07cd7007981180f1590df1523d9d4c6577031ba87984d046e854df48ed35e399a9c97de94ed788002b

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.php	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\php_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\php_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\php_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\php_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\php_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.php\ = "php_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\php_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2628	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2628	AcroRd32.exe
2628	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 2872	1052	cmd.exe	31
PID 1052 wrote to memory of 2872	1052	cmd.exe	31
PID 1052 wrote to memory of 2872	1052	cmd.exe	31
PID 2872 wrote to memory of 2628	2872	rundll32.exe	32
PID 2872 wrote to memory of 2628	2872	rundll32.exe	32
PID 2872 wrote to memory of 2628	2872	rundll32.exe	32
PID 2872 wrote to memory of 2628	2872	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Zeus-translation\temp\server\php\stats_main.lng.en.php
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Zeus-translation\temp\server\php\stats_main.lng.en.php
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Zeus-translation\temp\server\php\stats_main.lng.en.php"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
51c5fcae197982397c3035b20cc4cc1d

SHA1
48825add8beb3dbd4678f7e940e2cc8923d1b84c

SHA256
4e47cff75af01e0bf0d4208405c105e173bebef1307e21577786462a9b577b94

SHA512
6ca971812ede6e56ff867242468cb81f4a838da74017078a62df45e62f0c6207d3a212b842411d5759529de8c59dfdfb38c3c4484798f1d513c8e8f2d9f6351c

Download Submit