2cb8c7061773b62038fc601d72d770c384062963f729ad4ca717ce3ce7c15555

Analysis

max time kernel
103s
max time network
43s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Oblivity/depotcache/1389991_7145957302409288600.manifest
Size

58KB
MD5

0e5b19a60ea0eb08e6d76f3e214de51e
SHA1

70e7212227030ad01e82fce0eb58e3b90f6f6a19
SHA256

ff0f49431fd704aa9c77ee52f260089a008cc669f7949be3de1f86e0aa8f3c20
SHA512

e7afc7b658a995b3e65ccc67fd61828fddc02473ff7317dead5873d2b4b1d50f3351450d50159c0fa32b08a6d39b0a46a7b726f8153a6643796865199b6cb3d9
SSDEEP

1536:bECgQOLlRS+TzlCo495rlZz+TQx1XYFflKTuqJB8:HAlRCj5HQQrElKZ8

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\manifest_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\manifest_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\manifest_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.manifest\ = "manifest_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\manifest_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\manifest_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\manifest_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.manifest	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1916	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1916	AcroRd32.exe
1916	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2196	2072	cmd.exe	30
PID 2072 wrote to memory of 2196	2072	cmd.exe	30
PID 2072 wrote to memory of 2196	2072	cmd.exe	30
PID 2196 wrote to memory of 1916	2196	rundll32.exe	31
PID 2196 wrote to memory of 1916	2196	rundll32.exe	31
PID 2196 wrote to memory of 1916	2196	rundll32.exe	31
PID 2196 wrote to memory of 1916	2196	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Oblivity\depotcache\1389991_7145957302409288600.manifest
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Oblivity\depotcache\1389991_7145957302409288600.manifest
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Oblivity\depotcache\1389991_7145957302409288600.manifest"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f6fbb0e211cfdfbda8fa9db35f5ade86

SHA1
ae02a9a67973a3acf9138cc954c878d1009e83e7

SHA256
b9092832fc953d7cc20ae4e9219f0418e1141ad996184dae964f41bfd336c791

SHA512
9958127722c281724ccf55c8e8d7da54051b0a631358c983fdf59b53f36e98d689c54889e50b5994451ac2007ed23600c2687679398d1b227feee735dad8f6a2

Download Submit