4c8d6f202d7e0935bc5df645115288ae992df865b9240bdff63cbaaf7422a0e1

Resubmissions

18-08-2024 19:50

240818-ykjtgathpq 9

18-08-2024 19:48

240818-yh66zstgrp 5

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

patch.1337
Size

157B
MD5

f9ff11385e862b088293e7fe774b78f3
SHA1

a3207dda292b8160944091196a07b70c1f481988
SHA256

4b1af579cbf31c01664d2ee4ade6d0069391fab0f348146b146221700881e8cd
SHA512

ce50a091807c114a464fb1fdf7da5ad4e5351a866b4223de01145f868faa813e68b7af39b80eb37f0ba56639b8ce382b2a2fed10838654c020a8c2440ef63849

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\1337_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\1337_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\1337_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.1337	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.1337\ = "1337_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\1337_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\1337_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\1337_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2764	AcroRd32.exe
2764	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2248	1724	cmd.exe	31
PID 1724 wrote to memory of 2248	1724	cmd.exe	31
PID 1724 wrote to memory of 2248	1724	cmd.exe	31
PID 2248 wrote to memory of 2764	2248	rundll32.exe	32
PID 2248 wrote to memory of 2764	2248	rundll32.exe	32
PID 2248 wrote to memory of 2764	2248	rundll32.exe	32
PID 2248 wrote to memory of 2764	2248	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\patch.1337
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\patch.1337
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\patch.1337"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d4048b11bcba2d3d823150c9c4bc228b

SHA1
1c36cf4ee7103e67affc373598b6005d6fa04dac

SHA256
7ab664b76af4a865bceb8da460cfa4793656f791e8b6b7eb0bd7d5931a16f44f

SHA512
b746ee63d266d0df2e20b5cce0e9d3cdc044f719d00dd3647400e1fffc65fa72e359d8c6642b8bb6e6cc6141f0ddcf3a4081cb3418dabf6de760c95e48affa16

Download Submit