177c0d44829888987f89988f21973d8364853a864103d5bda9269e2b82e4bc37

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zeus-translation/temp/server/php/stats_os.lng.ru.php
Size

220B
MD5

961bdcb842a5ea58fe0659f480c90546
SHA1

e6a558394e300e63d5412981ffbb0b1c62bac03e
SHA256

9d3fb5719d5e10211fdccead96705f7fa1c2d6df163b59cce4af2c8039e0c53d
SHA512

ecd035a7a406fdfe66e88dc86f156127919a83f62479bda29c10e8e5ad23082e703fa65ba8798908b6ec0833300c5294eb1cd9854c035470302896e049403803

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\php_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.php	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\php_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\php_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\php_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\php_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.php\ = "php_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\php_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2844	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2844	AcroRd32.exe
2844	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 588 wrote to memory of 1496	588	cmd.exe	32
PID 588 wrote to memory of 1496	588	cmd.exe	32
PID 588 wrote to memory of 1496	588	cmd.exe	32
PID 1496 wrote to memory of 2844	1496	rundll32.exe	33
PID 1496 wrote to memory of 2844	1496	rundll32.exe	33
PID 1496 wrote to memory of 2844	1496	rundll32.exe	33
PID 1496 wrote to memory of 2844	1496	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Zeus-translation\temp\server\php\stats_os.lng.ru.php
1⤵
- Suspicious use of WriteProcessMemory
PID:588
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Zeus-translation\temp\server\php\stats_os.lng.ru.php
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Zeus-translation\temp\server\php\stats_os.lng.ru.php"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
72e7ce33740c7a12e322d10ff3e6eff3

SHA1
3ee0532a19f77a3700c505d10501655779f63d43

SHA256
113dcc043d27b8ae0ec8e5e3c79fda77db65d6c4b5b9da8f3e3e54882e19afe6

SHA512
74c31ae660389101215168922892411b9a62039d8d4c5846092c38bd13b7e4a0dd618dee1d28bb09586eecb8fdfbda7b6207d01489649c6d21ddef53bbae7ccd

Download Submit