Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-09-2024 19:43

General

  • Target

    org/spongepowered/asm/lib/signature/SignatureWriter.class

  • Size

    2KB

  • MD5

    ef5c41f3cad7a4933460f2c69373813b

  • SHA1

    85627b99273845bc402c297eb70ce756b36ed46c

  • SHA256

    d26fdb52fe33834570eb6298eb90661aa58422fc96862a5d49a65d688027876d

  • SHA512

    51bc9eb24fdac83fa0d1fcd88849f4df41073f7b3dada09e378ee1f48fe4792d92025f4695f07748e3a19d67d1272218df3a04be548fffcbb3a4ad0993cb5712

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\org\spongepowered\asm\lib\signature\SignatureWriter.class
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\org\spongepowered\asm\lib\signature\SignatureWriter.class
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\org\spongepowered\asm\lib\signature\SignatureWriter.class"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    1cbd453eab361aaaf517dca0ac274617

    SHA1

    3a6d5cae3c446253277c0b65184284b284d81fff

    SHA256

    728f2aca5845a24e6743d103b1195863079b3ef6084f5139524a2cf8a4d4f510

    SHA512

    62283a703f55ba6aa1c765d870aea6bd83dd395ed9eebef43cc6eba0e2f64a58e56004eb384180bb06f1fc289dfda390a161186fce7cb39dcf5a8019c2e1f0cd