030d09dedac5766992fc2f7f183e145f0d9a53b551c4f115265996a69644978d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

blob/{3a30aef8-e1c0-4d9e-8b3e-d8b6989361c4}.blob
Size

191KB
MD5

7ca571c5ee9930e44eee6d74a64cac17
SHA1

4647205fd0cd44ca7c5c71c02c5d4758d2a20ad2
SHA256

abbe9ab2b67521d4b5392be3e6d5d3c844871a1cdb30d9aa5c789d5f59a3d6d0
SHA512

123666d47efe91b00088947f4f3a812a5bdc807c8e2507b60e44fc6cc274998eaa4c5375244ad4d08e26f4a7ecdcfe51f85c9f612d7238ae05ebf46ef56911c3
SSDEEP

3072:ET6OwhJWosSpjp9i5BGeqJdQ4nd9fC930Y1cFHPJW:EmO/Si5Ed9a93D1F

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\blob_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\blob_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\blob_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.blob	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.blob\ = "blob_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\blob_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\blob_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\blob_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2264	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2264	AcroRd32.exe
2264	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 3032	2624	cmd.exe	31
PID 2624 wrote to memory of 3032	2624	cmd.exe	31
PID 2624 wrote to memory of 3032	2624	cmd.exe	31
PID 3032 wrote to memory of 2264	3032	rundll32.exe	32
PID 3032 wrote to memory of 2264	3032	rundll32.exe	32
PID 3032 wrote to memory of 2264	3032	rundll32.exe	32
PID 3032 wrote to memory of 2264	3032	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\blob\{3a30aef8-e1c0-4d9e-8b3e-d8b6989361c4}.blob
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\blob\{3a30aef8-e1c0-4d9e-8b3e-d8b6989361c4}.blob
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\blob\{3a30aef8-e1c0-4d9e-8b3e-d8b6989361c4}.blob"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
02dddf8be5a375a073277290b20d8385

SHA1
8a6cb142595eccfc7979393912a82292b7dba917

SHA256
274b71f2b33949c3c5d320a79b21927043d06215883438dcf5bdd9ef3086940e

SHA512
8d92083f7b13f38a8fbcaf8707b679b38fa0bb59f86501c408cb120821bdaeb39cccf5fe30ece0dd7f5b87c2bde1293401d2b05f9fec36697314169836e6e1e2

Download Submit