7559e6ca8b77400f88bf4e67208a1c32570a670068eccae9e3d226cc5471bd47

Resubmissions

15-09-2024 22:00

240915-1wpj7svapc 10

15-09-2024 21:56

240915-1tbwbsthne 10

20-08-2024 13:49

240820-q4v2vayfmp 10

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bazaar.2020.02.7z
Size

6.3MB
MD5

a2fc1e0d85da197a26203e22bdd1b5a2
SHA1

4c2f2158f440347a0f722cd81eb806e28481b868
SHA256

7559e6ca8b77400f88bf4e67208a1c32570a670068eccae9e3d226cc5471bd47
SHA512

6781742683061f15e74d6a62b16102dde83cafe1aa6f349e1ecec305dd3a72ea043709a19ec435a749e506efb4d93e82ea5ee620bfe60024a5782550eb7f8745
SSDEEP

196608:d98omomtNNy/aJF3Jf7KQrNIdaBtlCJNfx2944bl465o:d98omvMKZmQagtU0N465o

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2380	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2096	AcroRd32.exe
2096	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2380	1088	cmd.exe	31
PID 1088 wrote to memory of 2380	1088	cmd.exe	31
PID 1088 wrote to memory of 2380	1088	cmd.exe	31
PID 2380 wrote to memory of 2720	2380	rundll32.exe	32
PID 2380 wrote to memory of 2720	2380	rundll32.exe	32
PID 2380 wrote to memory of 2720	2380	rundll32.exe	32
PID 2720 wrote to memory of 2096	2720	rundll32.exe	34
PID 2720 wrote to memory of 2096	2720	rundll32.exe	34
PID 2720 wrote to memory of 2096	2720	rundll32.exe	34
PID 2720 wrote to memory of 2096	2720	rundll32.exe	34

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Bazaar.2020.02.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Bazaar.2020.02.7z
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Bazaar.2020.02.7z
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Bazaar.2020.02.7z"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2096

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\UnblockClose.clr
1⤵
- Modifies registry class
PID:788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
40c3d79b76c467b6f992ae9be36999cf

SHA1
17ab6f1b082bb4dffce219ed5f6cf16aad51ec6a

SHA256
1f8d0e8dc050af52449136faa6fd2cb44e6989303071c9efb835e2374c8547f7

SHA512
3e970483067d842da51970fedcc8f89eee5f3250d0337a5abb0afdd779ac5400de61017f5c41daf232539d53fdc225988d2dc4a260fcc7b1c06f33cdf63bc644

Download Submit