01f7a3f82659bdaeb7a73cc3e89d4e5811cfdfea310ebf0046ed8941528af012

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO BQ87574746.gz
Size

691KB
MD5

517158b1ede9e665f1dcc335b21a70a7
SHA1

b22b48ea6962fbe9aad860d88f745b7f6b9a58a4
SHA256

71dd2b89c1fda9ae7aa0ab2e7d44c1df68de978125a4b39a7872f34e70afe21e
SHA512

f38b1d01922db606bd532793afa6b1349c41ab502c68e658692913024e4e72cf37d8007dd027816a29715ec41b2601eaf23ecc52b068b08d3924f2fffbf7508d
SSDEEP

12288:xofUtYhMu5dA/Urfhr6jMlIPihtt6L3/kFN/esmLe0mgMHVRoei4j:xGUMCOrpCibEj/Je0uH72M

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2828	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2828	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2828	AcroRd32.exe
2828	AcroRd32.exe
2828	AcroRd32.exe
2828	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2376	2688	cmd.exe	31
PID 2688 wrote to memory of 2376	2688	cmd.exe	31
PID 2688 wrote to memory of 2376	2688	cmd.exe	31
PID 2376 wrote to memory of 2992	2376	rundll32.exe	32
PID 2376 wrote to memory of 2992	2376	rundll32.exe	32
PID 2376 wrote to memory of 2992	2376	rundll32.exe	32
PID 2992 wrote to memory of 2828	2992	rundll32.exe	34
PID 2992 wrote to memory of 2828	2992	rundll32.exe	34
PID 2992 wrote to memory of 2828	2992	rundll32.exe	34
PID 2992 wrote to memory of 2828	2992	rundll32.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PO BQ87574746.gz"
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PO BQ87574746.gz
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PO BQ87574746.gz
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PO BQ87574746.gz"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f11c5843e1448352828e7f9363eacfe3

SHA1
f7fc61acb099536f57abed5a92400b17ee39aadf

SHA256
44cf5072094d9c84c29e649b1f664187a198660b80388a6ea811f0c57d509978

SHA512
c9b7bf0cb3060b726a4dd470fc2dd076ad5c9cda7afe8725c73911491669130799c00c15343b349acc73b161143268adbb404d30713b029a835c9a19ede408e6

Download Submit