bbec7a6d4f3edf13e687545f8ae4709cf31b08d1feac57161598638c57f17f8e

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BuilderGUI.dll.config
Size

811B
MD5

3164da8283e95932cbb68aef15181359
SHA1

cf237d4e15f5104b3b62774510246971066679a5
SHA256

8b97c19381ff3a5972aa26dadefa1c7b72dccffd2ddf02ea3854fef252288175
SHA512

5b008905ec261b8194c32b309a4caca529453e73130a41b1b76e38aad852e3ddfc74b3f8d3f7ade165b61613c93f4ff41a6f0a172e0575c5aa93783737eb451c

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2772	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2772	AcroRd32.exe
2772	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2772	2480	cmd.exe	32
PID 2480 wrote to memory of 2772	2480	cmd.exe	32
PID 2480 wrote to memory of 2772	2480	cmd.exe	32
PID 2480 wrote to memory of 2772	2480	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\BuilderGUI.dll.config
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BuilderGUI.dll.config"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2e9854b3457d1df87f870b3c462ee4cc

SHA1
9d9b2188463af96240d6222732403cbdd7b67ba1

SHA256
555dbef3fd7228add20413737bf0b0cc80eb95a121691ebff4355dcf81163aca

SHA512
60b071625b80414cf102735aad7e55063d8d7e5caecbefde3d5dbe6ec14cb1720f4415feeda80e12060158f2b4e159b94f74b5180853acfc3cde343d92b3e414

Download Submit