18139a654a7161b085bb900abbe306b08694874d9288369f56e065c54af6f3f0

Analysis

max time kernel
122s
max time network
145s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/final.flt
Size

5KB
MD5

07b2e475d0489d79cd3d31c38c11386e
SHA1

f46182604726575b97a0fcb1e983513d7eb04657
SHA256

0428879b3fdc5fe720232869d636dc948d095bdd5a074575ae50f2bfad14f4b8
SHA512

376c0f829f024112f84f2435b3eb2194daa2b47d42b5556b1ae53e221298f31f401670616218ca65f1305743ccf59bdc21f4d4b103d80ead53c1c810308971ae
SSDEEP

96:31UPru7usFuZFuqFuJXm5t4PaByrMDvLj4zK2p:D7usFuZFuqFudnPaYrMzX4zK2p

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.flt	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\flt_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\flt_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.flt\ = "flt_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\flt_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\flt_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\flt_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\flt_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2252	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2252	AcroRd32.exe
2252	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2820	1720	cmd.exe	32
PID 1720 wrote to memory of 2820	1720	cmd.exe	32
PID 1720 wrote to memory of 2820	1720	cmd.exe	32
PID 2820 wrote to memory of 2252	2820	rundll32.exe	33
PID 2820 wrote to memory of 2252	2820	rundll32.exe	33
PID 2820 wrote to memory of 2252	2820	rundll32.exe	33
PID 2820 wrote to memory of 2252	2820	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\SimObjects\Airplanes\CS_B777F_GE110B1\final.flt
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\SimObjects\Airplanes\CS_B777F_GE110B1\final.flt
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\SimObjects\Airplanes\CS_B777F_GE110B1\final.flt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
93a3431b7beac2c93e420d0bc919f5e7

SHA1
5d1a88fa83df22fe8da822c4573a8038b53f5d0c

SHA256
2dfb671e75abaa489ae6493fcd5945e24e59f32a45190c80774f95f8a19a0ab5

SHA512
0f520af8d9e52e86c9b93c43a5d5b09ad3707ab7db92768b518d0aa0191ca84596acdc0fedfc69a1e3f36039c8d0ae73ff509dfaa0b82bc7b98567f09a08b3d1

Download Submit