a1664e381cb130cec3231c27441323ffb829529ec73bddf6c17313de51401768

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.tar
Size

19.6MB
MD5

dfab968eb4c7bb6143e0e11bfc52d422
SHA1

0abe79dc7a5f1ebfab8829b1dd70c2a5f10ad754
SHA256

5d33b27a6db618c569a0619a36883e43c6c84832d4cfc0f16758811fd3e4f925
SHA512

05165ee8c1f5892aca4635e2d437ffea40e277c07b364857722152b7c805b11128111cfdcd8b40d4480d7312534e8dd6df2d509373fe252597559a700ae99f49
SSDEEP

98304:kAmH5grhf/An3Wfb7cVSUrS97unTjoHlhvlOAT6Mb8:k7KfjovivlOAO

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1104	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1104	AcroRd32.exe
1104	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2132	2112	cmd.exe	31
PID 2112 wrote to memory of 2132	2112	cmd.exe	31
PID 2112 wrote to memory of 2132	2112	cmd.exe	31
PID 2132 wrote to memory of 2740	2132	rundll32.exe	33
PID 2132 wrote to memory of 2740	2132	rundll32.exe	33
PID 2132 wrote to memory of 2740	2132	rundll32.exe	33
PID 2740 wrote to memory of 1104	2740	rundll32.exe	35
PID 2740 wrote to memory of 1104	2740	rundll32.exe	35
PID 2740 wrote to memory of 1104	2740	rundll32.exe	35
PID 2740 wrote to memory of 1104	2740	rundll32.exe	35

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample.tar
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\sample.tar
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\sample.tar
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\sample.tar"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
35b44ec2f68bd63303702ee7b12a231e

SHA1
685872b1d4f60c5c89d343a50fc707669e47a436

SHA256
f0780a7a8335a69e8cc7e105d4a2afd01fd317f54ee06150866c19377ba341ff

SHA512
8c1c139dd6ee1bad6e809626bec218458c3c7bf913a8c8b24508f4ccebf4751cc0148002ee144995bb9c83f49e57009638f1262ab1b7e691886575b1ad899a52

Download Submit