76c0fea917bcfdec6d57d1f4efc89dea7eadc6f2d02cfd0c3bef0f68284b1c7d

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

me/vagdedes/spartan/a/a/a/b/c.class
Size

4KB
MD5

8413f2a55f8185a4b1d75ea5b0030f20
SHA1

ac74e38c3daff24d2caa53978a42e3b150977e06
SHA256

6fde110845aa8e745bebcdc6badce29a0c610639f57c15a6c22d19d3912fa015
SHA512

bcc8c64eb727daf86dc96a89e547c66b58895839e8d1197abe76d92ac4c358f9fc3fd80615467d54c617d80a6c792a226d512f0b3b68f8dd9e47a9603e127211
SSDEEP

48:5UVBlcO5XI2fvgR0x7Zt4vzEk73l3D6Bp3Sw5e0l3ywK8uo7I2b9f9hVAsKY1HWD:+/L8084k71T6aCe0lmgUIp9hVlKcOF

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\class_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.class	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\class_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\class_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2004	1936	cmd.exe	31
PID 1936 wrote to memory of 2004	1936	cmd.exe	31
PID 1936 wrote to memory of 2004	1936	cmd.exe	31
PID 2004 wrote to memory of 2720	2004	rundll32.exe	32
PID 2004 wrote to memory of 2720	2004	rundll32.exe	32
PID 2004 wrote to memory of 2720	2004	rundll32.exe	32
PID 2004 wrote to memory of 2720	2004	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\me\vagdedes\spartan\a\a\a\b\c.class
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\me\vagdedes\spartan\a\a\a\b\c.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\me\vagdedes\spartan\a\a\a\b\c.class"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a92aa4a9eed2f196c43ced19223ff7f7

SHA1
5896d2f7477abd2ae17494cf1b6a40ac24d86edf

SHA256
0977fdd57866f804df1cde20b41aa25d35a93faa2807ac698fead9aa6fc0aef8

SHA512
dbecd1610bbb237783803ada3fb224d8d12cc4ce6006c3a8e9c02b235d67d72e6d8fb192b6c122cbc9ef088fe4b0f4e80e8209c82c5a5f6577af258722bba1f5

Download Submit