1aaf139d28aebec2bd164929be934433b8097a6729352a9c51ba52714aacb691

Resubmissions

25/08/2024, 10:12

240825-l8vvesyeke 3

25/08/2024, 10:07

240825-l5r95aycpa 3

Analysis

max time kernel
597s
max time network
617s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/Licenses/cairo/COPYING-LGPL-2.1
Size

26KB
MD5

86ce596bc517e1d7c5fe6149c75b1bdf
SHA1

01a50bc2cba30010116c6db30a2bce318a7a40de
SHA256

6f900e8acd64a5451373d39271cdb4ff55e073855574b0b1ad99a86c728545a5
SHA512

2d19f2cf7604a9f83784585afe36a90cf323d34708687b1f4df72b445438df6bd8d8d686a1f1e5fa6df7063a3942c1d061182360561c9dcf8fff1c9899695e75
SSDEEP

384:VjIBNk+x/vIq001qX6sT6AATeINgKP+nHQg1fgcmmItyOQeMvZrWEJZnjuo4:V0Bqs/qOTeDnXqFXOrlJZnjuo4

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.1	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\1_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\1_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\1_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\1_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\1_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\1_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.1\ = "1_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2592	AcroRd32.exe
2592	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2820	2512	cmd.exe	30
PID 2512 wrote to memory of 2820	2512	cmd.exe	30
PID 2512 wrote to memory of 2820	2512	cmd.exe	30
PID 2820 wrote to memory of 2592	2820	rundll32.exe	31
PID 2820 wrote to memory of 2592	2820	rundll32.exe	31
PID 2820 wrote to memory of 2592	2820	rundll32.exe	31
PID 2820 wrote to memory of 2592	2820	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\The Henry Stickmin Collection\Adobe AIR\Versions\1.0\Resources\Licenses\cairo\COPYING-LGPL-2.1"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\The Henry Stickmin Collection\Adobe AIR\Versions\1.0\Resources\Licenses\cairo\COPYING-LGPL-2.1
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\The Henry Stickmin Collection\Adobe AIR\Versions\1.0\Resources\Licenses\cairo\COPYING-LGPL-2.1"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d411b12dca22649e3d76073e84765224

SHA1
5bfe8f25d91850b4ab52c3752deaeb1d2f14356d

SHA256
a1f4b5e411221312c67b75623a4b38d5b195530d2f46187426930ac665830851

SHA512
a70e67cd83be1d84d76269a56a8e39123cacafbaf7b4c1afe5f5f92eab606cd619fcc9bf5322f2a62845243fb16c625827d13d1e1b5e5ec77435fb0ac1e43fb7

Download Submit