1025d1d8ded39150086a76a16ea84b0719f0e6594900ce066f617ad620aa5ee8

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Blitz Hyper Edition FV Honey/chars/Amy/AmyArcade.zss
Size

2KB
MD5

00ff91ac928095562af1eb99b49a53ab
SHA1

89b6f1991a4621c8e097dd9ac7f198618c8ebcc9
SHA256

4314b5592077e37bb4639860564b126d745d88911b2fb44a3fde4527530a5ac4
SHA512

108dc3d9f5380e1ebd7602718a0be0438ac8b9e8945ef1df372896eae917dbff36ef08a71bd0472190c25f9b4c79e82d2db0cdf69a776fde270fb5d349fb524b

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\zss_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\zss_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\zss_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\zss_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\zss_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\zss_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.zss	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.zss\ = "zss_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3000	2868	cmd.exe	31
PID 2868 wrote to memory of 3000	2868	cmd.exe	31
PID 2868 wrote to memory of 3000	2868	cmd.exe	31
PID 3000 wrote to memory of 2720	3000	rundll32.exe	33
PID 3000 wrote to memory of 2720	3000	rundll32.exe	33
PID 3000 wrote to memory of 2720	3000	rundll32.exe	33
PID 3000 wrote to memory of 2720	3000	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Blitz Hyper Edition FV Honey\chars\Amy\AmyArcade.zss"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Blitz Hyper Edition FV Honey\chars\Amy\AmyArcade.zss
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Blitz Hyper Edition FV Honey\chars\Amy\AmyArcade.zss"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
65fc857a166a26b453e45c287ad43059

SHA1
eb022b1e8a7789a8033372c542303611c28a3198

SHA256
7e82c94a257ecfdd83dd50923be3c6834c4fc13321e5a612503ab14c157e494a

SHA512
49079a49aaee800b866ca3efd457a78fc3e9b54eb8553841d3aad43c4d6344e6b116822120bbea4382f90451b6cc7d977f53297d480b9e6544d42e7e6f9cbe12

Download Submit