eb39e3c3215ee01a3ed0148766b22b139d1cf42a3631b7c99144ae2d181bbb8c

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
30/08/2024, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2017.6.30/016.vir
Size 42KB
Sample240830-ck7dwascka
SHA256 f3c4c2bc1dbfaff708160dd5cc0fde322e09ffbbbb251a7a281ce550853e2406
MD5 41d7cb8ed4cf0e8e7f7dad55f61f1f92
SHA1 227aa7b8f44cfe653b089562c2e8f454ec532b0e
SHA512 caa29dbf300d2dc872e016d5e7b5f93833b7c1e4313f92fcdb3115fe84d7efd11468aea826b0e01e009b1482f312c7a6fb9d6d34bbcfbeb9615aecd316cb7f74
SSDEEP 768:yND7uJvbqi1suCpCxuKFS5yJYgHU71QtWSADh6k7UB3+J4KCPR+NGAln:cu9O8NvFPYCm1QMNjK3+JDCR0hn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.vir	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vir_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vir_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vir_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vir_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.vir\ = "vir_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vir_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vir_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2732	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2732	AcroRd32.exe
2732	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2132	2296	cmd.exe	31
PID 2296 wrote to memory of 2132	2296	cmd.exe	31
PID 2296 wrote to memory of 2132	2296	cmd.exe	31
PID 2132 wrote to memory of 2732	2132	rundll32.exe	32
PID 2132 wrote to memory of 2732	2132	rundll32.exe	32
PID 2132 wrote to memory of 2732	2132	rundll32.exe	32
PID 2132 wrote to memory of 2732	2132	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2017.6.30\016.vir
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\2017.6.30\016.vir
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2017.6.30\016.vir"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 33abf047e5bb0273b9a69cc75db7588207da96c72a710db7dea7f9eb6ac88ba2
MD5 17033c861a6d2952e6f324095102dd03
SHA1 81cd9fd6ffba3fd7b4ef92e4f63b55344204750c
SHA512 0743cb28c1e4a903edf27d991afbcd13d6311bde99f8b29fb2573c55e86c631768f227b7007630e31d036c9bcf6288fdd7c10a1f3e6a564022dcf5ed064e41e1
MD5 SHA1 SHA512

Submit Download