9c5f193fc0057d06c8be677ab806baaed3508d3e91f6dcce5bd297eaa704494f

Analysis

max time kernel
316s
max time network
321s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SceneryFN Launcher.exe.config
Size

563B
MD5

467c9988e896a5596d1c64968cdcff73
SHA1

cb35ca253aba7ed4c89d194e8e8be1c5acc79083
SHA256

dd2a10593cccb1d99df5d76e63cd5081ba7e3387aed34ded0ef9588aacd4d3a1
SHA512

1b647af7f01fefc1d4d53f8057fc277e90eea5782472a8e3b809bfbb56a69504570f21874ea1370bd6423083e1f49e869db2c7d39a35b3f176ed81c738e6f43d

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2632	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2632	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2632	AcroRd32.exe
2632	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2632	2212	cmd.exe	31
PID 2212 wrote to memory of 2632	2212	cmd.exe	31
PID 2212 wrote to memory of 2632	2212	cmd.exe	31
PID 2212 wrote to memory of 2632	2212	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SceneryFN Launcher.exe.config"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SceneryFN Launcher.exe.config"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
645be4b905ff888d3d4001874cb18ddb

SHA1
ad933820fa7074ae33643f2897f51fb14102ff3a

SHA256
f88c549ab7869f221e2f44cf796ba0a7baf9cdee11a39f9afc93a3498673cd89

SHA512
33cd1e5636a3d281d2ea72921531d1290c644021fccc82672e64f632be31fcea388e8f885e4002ec04ed0218ebe8d8fb771903d3589a0ff6682c8dcd71d43622

Download Submit