4cc3e1a474bb32f8f766598c76359a8a2c5da0ce3ae0b3ea544c61b435df1c95

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

entities/bow_arrow_2.behavior.json
Size

2KB
MD5

fa75beb095b2b53fc8501e031ba8ac2a
SHA1

2cb220d4c4709046a055f963387cb153329d1c26
SHA256

5b86881a03e5bd1804347a6c08fcdcb747e643a966fd6eb35da058e7c5ad6027
SHA512

770603fa6391525266729ea48641f8bc3b1c0efa9ddca20607f4431938802ab84f8de81fd62f6e10832e8e1feefba30fd829924eb72016c78fde177222864ed2

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2880	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2880	AcroRd32.exe
2880	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2816	1740	cmd.exe	32
PID 1740 wrote to memory of 2816	1740	cmd.exe	32
PID 1740 wrote to memory of 2816	1740	cmd.exe	32
PID 2816 wrote to memory of 2880	2816	rundll32.exe	33
PID 2816 wrote to memory of 2880	2816	rundll32.exe	33
PID 2816 wrote to memory of 2880	2816	rundll32.exe	33
PID 2816 wrote to memory of 2880	2816	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\entities\bow_arrow_2.behavior.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\entities\bow_arrow_2.behavior.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\entities\bow_arrow_2.behavior.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9fc6f8909a1630053501a5430aef979a

SHA1
5c0869f3b8e1e05adfeb8441bc3e1f5f0285b27e

SHA256
e711c50add2e3d0f6d1e9c87f1ae8fc9dd6658d39fe4c238746f6ff716be88de

SHA512
0583d4debe8a49aa09f6bea89473ca7ba89bae02eccc5a10463b1247abdda2a8708f355a1c56ca72515b478be7e0b48440edeb430aaa95396868c2241854a3df

Download Submit