f32c3fb0bf2016c1f8ad700fdf278a7362210900c365ec8155c2c667c97fb579

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Opsamlingsbeholdere119.bes
Size

405KB
MD5

a6b0286190ff25673a5bbcca3e635e17
SHA1

b50d863e08054654434eeead618ae36d66f5ad59
SHA256

2587546927274a33be48c542ad1b98e07df0c2a8503afbc1f260ebec1cb13ede
SHA512

1f9c0f6cd3be6f79168bbd9b07931181cae135d144da4e569191e42bf66c5af0be49c894e1608a4c45c3be38dfd47eb912cba4dadb660a688474b1a3f2acc72e
SSDEEP

768:r1/VRVN7GaY97mbexftA4Z+RRCLDHuPxfARLhzR+9wBhtOxALX5Wa/5X6dJddvt2:LMxA4/Lf6dHgeGxN37ruZwuLi+OLj

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2804	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2804	AcroRd32.exe
2804	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1848	3060	cmd.exe	31
PID 3060 wrote to memory of 1848	3060	cmd.exe	31
PID 3060 wrote to memory of 1848	3060	cmd.exe	31
PID 1848 wrote to memory of 2804	1848	rundll32.exe	33
PID 1848 wrote to memory of 2804	1848	rundll32.exe	33
PID 1848 wrote to memory of 2804	1848	rundll32.exe	33
PID 1848 wrote to memory of 2804	1848	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Opsamlingsbeholdere119.bes
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Opsamlingsbeholdere119.bes
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Opsamlingsbeholdere119.bes"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fb103ad099aa2c2f0cce1f1eeedae085

SHA1
997517e40b9103b145430eeba9adf0f644372daf

SHA256
1ff8843cdf669250603837936b13234efb8b940f91b5057466015f54d62c23d9

SHA512
547e9da5ece5a90c2be792419f7f97fc22ecd1a5601efc99eb9df36a96ad45116536460091040f1434f7e254ce1700c959b05c719edc835b7142276e9fcaea89

Download Submit