4a742110c529f0989f5691294ca60c7fb7537b6cc3824308638ac92e81916f8e

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

BeatEdit v1.2.006/BeatEditForResolve.lua.bak
Size

2.0MB
MD5

92ef1a6ff29952a227013da8dc6587ca
SHA1

dc552b0915fb99448daaad05a06fcc382089b243
SHA256

7c3e1a906f9ce35230de23d23ccd002f337c723ad2183a50feab3558a5ae994d
SHA512

75bfd912f2192d9aea93f45cf2521b523081267da05be294e364d08ea29f18eefdfeeedda93fd5cd454ddcaa62d383c0ffb7209600588d6ed5a7e451802df0ae
SSDEEP

24576:H9qDV+weNkhmEVoeOribi5RFOZOs23RvDuf8UvqIK7PrQtpx2W4Q2y:dqDVNeNkgisRTDYBo7wD4Q2y

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.bak\ = "bak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\bak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\bak_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\bak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.bak	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\bak_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\bak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\bak_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2984	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2984	AcroRd32.exe
2984	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2280	1304	cmd.exe	31
PID 1304 wrote to memory of 2280	1304	cmd.exe	31
PID 1304 wrote to memory of 2280	1304	cmd.exe	31
PID 2280 wrote to memory of 2984	2280	rundll32.exe	33
PID 2280 wrote to memory of 2984	2280	rundll32.exe	33
PID 2280 wrote to memory of 2984	2280	rundll32.exe	33
PID 2280 wrote to memory of 2984	2280	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\BeatEdit v1.2.006\BeatEditForResolve.lua.bak"
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\BeatEdit v1.2.006\BeatEditForResolve.lua.bak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BeatEdit v1.2.006\BeatEditForResolve.lua.bak"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ea9eb021f10dbde02b2a23d04b952949

SHA1
5dfe6c6d916f83d9c408f4f761726048ce61266f

SHA256
025aad8d82134029672438a10616468ab2dce1ec00d9b76cfa5f514ae20cbf75

SHA512
51860a79488a10d0ed6fb4e382c2a7110e55e8d092ce9f9dada4275cb94eba68dde9d5b0968431c4278c0e0e53b08b1e5b612d2a07a97cd5a637b3fde4a5c58b

Download Submit