9d57217b740a9dba870e96db446745bc008e57a7356d6ace1f3c5c7059a22200

Resubmissions

29-08-2024 23:36

240829-3lmnzaxalh 10

29-08-2024 06:31

240829-g98epaxgjh 10

29-08-2024 06:23

240829-g5jkrszckn 10

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d57217b740a9dba870e96db446745bc008e57a7356d6ace1f3c5c7059a22200.dex
Size

4.9MB
MD5

9fed9bb00615b90f79a94e70e9aa14f9
SHA1

373338ac03ea5054a35722f1725c4ac9492e9833
SHA256

9d57217b740a9dba870e96db446745bc008e57a7356d6ace1f3c5c7059a22200
SHA512

0f27bc18978eced5e464782297fc398d12b8257ce317478fcdee7566803856fa9929f266e5c9749e0eddccb22c8e4edc90eed9e7ce53009eee040dfc763812d0
SSDEEP

49152:FwQtBaSIQG37+UMLmpSyFrqHaWIqbWJlPhjjK62pyEbPzWYqLoQEp9Z1uTMB9GPL:qQtBaSsyUnSyp8WJl9K62Clo1uAzK

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\dex_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.dex\ = "dex_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\dex_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\dex_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.dex	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\dex_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\dex_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\dex_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2140	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2140	AcroRd32.exe
2140	AcroRd32.exe
2140	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2552	2284	cmd.exe	31
PID 2284 wrote to memory of 2552	2284	cmd.exe	31
PID 2284 wrote to memory of 2552	2284	cmd.exe	31
PID 2552 wrote to memory of 2140	2552	rundll32.exe	32
PID 2552 wrote to memory of 2140	2552	rundll32.exe	32
PID 2552 wrote to memory of 2140	2552	rundll32.exe	32
PID 2552 wrote to memory of 2140	2552	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\9d57217b740a9dba870e96db446745bc008e57a7356d6ace1f3c5c7059a22200.dex
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\9d57217b740a9dba870e96db446745bc008e57a7356d6ace1f3c5c7059a22200.dex
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9d57217b740a9dba870e96db446745bc008e57a7356d6ace1f3c5c7059a22200.dex"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
03566d85064f96e9918691376645c093

SHA1
67e189d46120cd75d2134ffb8e0ca4c2c10fc094

SHA256
4791a8fdca13d4b0340d641e2a97264fdc8bbacd50b6e341a8c8c5e4d39c0b46

SHA512
5941e525e28822c31b14c8d912f136264d75cc67842e7eafec694d67253e9d29378954c7033defe723f0421542ce0c005e8b6b41aed9f55cafe68955174548d8

Download Submit