4054597a56dc5867ec53af1767416a5336e09423ecd101d8ee52aaad8a3547c6

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

org/spongepowered/asm/lib/signature/SignatureReader.class
Size

2KB
MD5

0ec8cf0c102329f6401da6e8d91e0072
SHA1

ae069200e3a37e01e39fcc6a02a2ceb77318f16f
SHA256

07150d8e1ef523112d1d682a99600102b5855e777da4251002235094232989d8
SHA512

30d766c7d17ffec5c34dc0493d2a512db1c925e39887934826bf2e1b66bc2aaaf5321db28fa18f001dc6e8820a644d094f6e92decf19a6ab5574143aaa2fb92d

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\class_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\class_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\class_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\class_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.class	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.class\ = "class_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\class_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2760	AcroRd32.exe
2760	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2796	2556	cmd.exe	31
PID 2556 wrote to memory of 2796	2556	cmd.exe	31
PID 2556 wrote to memory of 2796	2556	cmd.exe	31
PID 2796 wrote to memory of 2760	2796	rundll32.exe	32
PID 2796 wrote to memory of 2760	2796	rundll32.exe	32
PID 2796 wrote to memory of 2760	2796	rundll32.exe	32
PID 2796 wrote to memory of 2760	2796	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\org\spongepowered\asm\lib\signature\SignatureReader.class
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\org\spongepowered\asm\lib\signature\SignatureReader.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\org\spongepowered\asm\lib\signature\SignatureReader.class"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
55bae0834ad4a7b7d88b31d2b4e024c6

SHA1
2a258d61256c4008ac79497808ca85a352c47f23

SHA256
0c5791c0f91ab2af72789baffde23da6e7ba53163ce42e1528a4af65fb29d127

SHA512
672fdcf89b8b7918bbdc7a193debe3bc6a99a1630d321793c065fe55959caf1955e9dc873e7961ccb34dd8e15cff99d5ccf5405eae985855f83cb8ea6be5aa10

Download Submit