76c0fea917bcfdec6d57d1f4efc89dea7eadc6f2d02cfd0c3bef0f68284b1c7d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

me/vagdedes/spartan/a/a/a/b/a.class
Size

3KB
MD5

7b6aea1bb396e0483511a7a40c6a006c
SHA1

066795734e7f36b333ae53179c7e3cb2b9864b76
SHA256

67225625a19e97c5bc47aeae35d847646d1bb5d9e8e5becce6a1dee29a9d0db0
SHA512

e95c9668de95424620a13deb1783807c386a417abeab30a44a11d86204ad16c6de54eab87fc5c2022f4cf0e9afe8f14d2b4fb7bbeca2449300c9d82b41386206

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\class_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.class	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\class_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\class_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2884	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2884	AcroRd32.exe
2884	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2280	2956	cmd.exe	29
PID 2956 wrote to memory of 2280	2956	cmd.exe	29
PID 2956 wrote to memory of 2280	2956	cmd.exe	29
PID 2280 wrote to memory of 2884	2280	rundll32.exe	30
PID 2280 wrote to memory of 2884	2280	rundll32.exe	30
PID 2280 wrote to memory of 2884	2280	rundll32.exe	30
PID 2280 wrote to memory of 2884	2280	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\me\vagdedes\spartan\a\a\a\b\a.class
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\me\vagdedes\spartan\a\a\a\b\a.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\me\vagdedes\spartan\a\a\a\b\a.class"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
05df0cd76729fe465c00097a5a8bef3d

SHA1
8a7e16b12ae7e6558193532772fbdbdfc395ba18

SHA256
068a3143ee253a50ee8a6cdc32b2f37c949ab17c57cd62938dc1e61808662eec

SHA512
bdbd52f79bc614e84898ba3d79e22b5f0b680e897896bc38ce38f6cb15708ea83bfe03f084bcf63905a28fd6daec7bec7a31cc112971d4fdd02cd759c68604d4

Download Submit