1eaccf1be734304c9ebc0039e09aaa28df7ad3df41b5beec3b66b9e8ab212f3c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.json
Size

2KB
MD5

dde53175c0125e2ba9e1d0208af96781
SHA1

99f3eb2e41e1c1c9569f6c3d34cabbe300deff02
SHA256

137cda5d0b7943c12adc0b6d6f556431f6a25adb5a004d3bc3f9ff555513aa5e
SHA512

cb3d97412359b162d5db98bf64897966470fe15eca7627bbdda7b7e1fe3b8a82244907b345f311f6f2e2901298ac4e03ca0365ce3aed5bd2f5b83adec10e25d2

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2828	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2828	AcroRd32.exe
2828	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2156	2380	cmd.exe	31
PID 2380 wrote to memory of 2156	2380	cmd.exe	31
PID 2380 wrote to memory of 2156	2380	cmd.exe	31
PID 2156 wrote to memory of 2828	2156	rundll32.exe	33
PID 2156 wrote to memory of 2828	2156	rundll32.exe	33
PID 2156 wrote to memory of 2828	2156	rundll32.exe	33
PID 2156 wrote to memory of 2828	2156	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\index.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\index.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\index.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
110ded4aaac5e71cc310311a67b86f45

SHA1
6bbb125e321c34e650491009dc18c9bc79e0f5eb

SHA256
e29a13ca92b474d211cefe90cd8f6dc5661ab4a2d3ba75e988242d6756687dea

SHA512
53191fc579c570aa59cbed348efd51a035ee371b788babbaa223b5827c83b64a040786248179a3269ed536b2980d819bb855e6830d7f9e5fa8a3fd736946165a

Download Submit