9ec0d034052df060d26c172ca0cf8d26f252dc2f7faf09a700ccf9a871485dc5

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Temp Spoofer/client.7z
Size

12.2MB
MD5

3fbcec19b305d4f5c6d873a25ced93fe
SHA1

da20aef8180132c3ccc9d25a8ab65f7b330881af
SHA256

d63869617852c5be06064fd50525eb5d819e96e977a191fd189a2ec98b628cf3
SHA512

850131ca6932844b940a287ae62421e00f754daafed06ca2c78b443ac393f2a405fde4e920690b6e70d61886e33c07291f49583212b52ce6223b8e477a3d2606
SSDEEP

393216:ghlXi+bnoaDEPEiftDlxa+r+md5Bjv9Ic3v:g7XVR+EUlZ+md5Bjv9Icf

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2452	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2452	AcroRd32.exe
2452	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2008	2548	cmd.exe	31
PID 2548 wrote to memory of 2008	2548	cmd.exe	31
PID 2548 wrote to memory of 2008	2548	cmd.exe	31
PID 2008 wrote to memory of 2748	2008	rundll32.exe	33
PID 2008 wrote to memory of 2748	2008	rundll32.exe	33
PID 2008 wrote to memory of 2748	2008	rundll32.exe	33
PID 2748 wrote to memory of 2452	2748	rundll32.exe	35
PID 2748 wrote to memory of 2452	2748	rundll32.exe	35
PID 2748 wrote to memory of 2452	2748	rundll32.exe	35
PID 2748 wrote to memory of 2452	2748	rundll32.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Temp Spoofer\client.7z"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Temp Spoofer\client.7z
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Temp Spoofer\client.7z
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Temp Spoofer\client.7z"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f1ec6fe95c85d96773755c377a467f78

SHA1
c1241d95ccffbefe02dbb84fa77ee256868e7f61

SHA256
d97ba4a15c722ba27b5d673428701ded824a1ab8b110b56cfffe00650ed5ddd5

SHA512
d92935aa5f069c42e246241b982fb6d277e1be9b152167dc3372b5dc015fc247d7f714b11ecb701045f8da4114b7afd687eea5f11d2fc446fcb68c64a193110a

Download Submit