e7540e416771a4532807a975e55c934110fd0d1f906d08a400b133e94bebe4c9

Resubmissions

11/09/2024, 18:46

240911-xe5y3swfpp 7

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dolby_Atmos_Setup_and_ControlPanel [PeskTop.com]/Dolby_Atmos_Setup_and_ControlPanel/Readme.txt~
Size

360B
MD5

73c03b6d4f97a68da6bd76cc2da9b054
SHA1

dbc4f2fdbc108fd96a6bbecb958d3d2ad2a4f503
SHA256

0fec6abda33042e7a9cb9b38ef36aef21103b46822f13942a72a3443a0d6bf4e
SHA512

61e64fecf01cbf72c9d34a472611758f032ac43bc049679259ed0b6a2496e14e6b0c3f987e066388b17abec7d8da34a4e5647c27a81d1f79db8c0e78156d1276

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\txt~_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\txt~_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\txt~_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\txt~_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\.txt~	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\.txt~\ = "txt~_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\txt~_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\txt~_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
532	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
532	AcroRd32.exe
532	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2152	3040	cmd.exe	32
PID 3040 wrote to memory of 2152	3040	cmd.exe	32
PID 3040 wrote to memory of 2152	3040	cmd.exe	32
PID 2152 wrote to memory of 532	2152	rundll32.exe	33
PID 2152 wrote to memory of 532	2152	rundll32.exe	33
PID 2152 wrote to memory of 532	2152	rundll32.exe	33
PID 2152 wrote to memory of 532	2152	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Dolby_Atmos_Setup_and_ControlPanel [PeskTop.com]\Dolby_Atmos_Setup_and_ControlPanel\Readme.txt~"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dolby_Atmos_Setup_and_ControlPanel [PeskTop.com]\Dolby_Atmos_Setup_and_ControlPanel\Readme.txt~
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dolby_Atmos_Setup_and_ControlPanel [PeskTop.com]\Dolby_Atmos_Setup_and_ControlPanel\Readme.txt~"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2d64b8aaef64987c5a1cb8b4b672d4b1

SHA1
f39fb5786c4155f77fe70c90194bb72113c66405

SHA256
9f31ec4e80172a50829e6af9712aa5e7552cf72ffd1c183ad0e72838685a50a5

SHA512
b414131df5a33bcd4494a93f28a37978c7a8642cef58c92c53b027bfa2ecf7ab10a196949038975a6c4aca7ff7bfe2db6b6e8ee07b8a12bb58e8088e369c8c3c

Download Submit