f7815423252ec07ec5de28eeaa7f65ae3d8b91be8d48d7567f123133f51b2ee3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

112.bin
Size

146KB
MD5

0d08df479987d20b9c4e514c9f100751
SHA1

26a11ea95740e514d84052ed240d47b29b735f7c
SHA256

f7815423252ec07ec5de28eeaa7f65ae3d8b91be8d48d7567f123133f51b2ee3
SHA512

d21b8e66013ce041c464f9b38cd901fe01a5cb1d1245b312a61d23e9b1b24fa64df865401a48ce76df454dbd3f64482fbaa4ac80e8d35532c9cd60209cb508cb
SSDEEP

3072:XZPSiJgwuvDD4LsHf4ZetSrcMGj5ZXMJ9MRKXBwLs/:YIg7D4Lsi3IL8jgKXAs/

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\bin_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.bin	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\bin_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.bin\ = "bin_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\bin_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\bin_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\bin_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2772	AcroRd32.exe
2772	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2980	3032	cmd.exe	32
PID 3032 wrote to memory of 2980	3032	cmd.exe	32
PID 3032 wrote to memory of 2980	3032	cmd.exe	32
PID 2980 wrote to memory of 2772	2980	rundll32.exe	33
PID 2980 wrote to memory of 2772	2980	rundll32.exe	33
PID 2980 wrote to memory of 2772	2980	rundll32.exe	33
PID 2980 wrote to memory of 2772	2980	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\112.bin
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\112.bin
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\112.bin"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bd7b53c74f1f5af224d733100dd2cbd2

SHA1
d1256d77a77c46dc3c3a94df3d8bf8f3362155e3

SHA256
24a3c15b58f7ff0df63bd7abc1ba81e95e59326a4f1e91876b78f3ad99ec69d9

SHA512
6349d1e7397a8f69c585453271e6f64a4caa4d7fcfdba2e2b07b77cbd793dc1fe229b89b5eb00306d6bf2618be69c7fd60477ad9751034d493d9337b8eb0b6cb

Download Submit