83ba4e290da54c23797a42fb6d97b9381a067134c8a19267071182ab8595473d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 21:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bermudashortsene.env
Size

276KB
MD5

e06a0946e057e315affc260c204cdc0e
SHA1

0c1ef05c8d51265a7c74189991d991402a6825d7
SHA256

1c500e7d838da0599cc08998bff2ae7a4ff164dd0d14fcd68276d8738b8100e6
SHA512

beb8e3894f433ffe1088cbeab47e302c96d8a83cf522ce8cfa3176c9155b344d96a7ff0a0d59b5450cea5588affaf09555ae2e15daf04e00ea2615821f14348f
SSDEEP

6144:wWcBZ4Uh17EpQUjQXXHQAh1EjQrCuxScxkmK9iuB6:oBZh/4p7SXjPEjGCuoqKYuB6

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.env	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.env\ = "env_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\env_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\env_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\env_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\env_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\env_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\env_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2760	AcroRd32.exe
2760	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2168	2092	cmd.exe	31
PID 2092 wrote to memory of 2168	2092	cmd.exe	31
PID 2092 wrote to memory of 2168	2092	cmd.exe	31
PID 2168 wrote to memory of 2760	2168	rundll32.exe	33
PID 2168 wrote to memory of 2760	2168	rundll32.exe	33
PID 2168 wrote to memory of 2760	2168	rundll32.exe	33
PID 2168 wrote to memory of 2760	2168	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bermudashortsene.env
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\bermudashortsene.env
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bermudashortsene.env"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5e45ff7b5a034f4dfd5eb3935a0583e4

SHA1
52ed8dab657666a30b170aed1d77f9fb78f52a83

SHA256
4f3d6ff26359c442352e4b98665bc646daf2e2b1d9f2b2255df95c5b67cbc93a

SHA512
3c60868e68a18dec56c101c0f48a616a8f289e4108c7508e8c8cb2fc61c589dc237e302a1de4d395cfe9b14c783000319f6b1e80a135e26aa235fbda88478342

Download Submit