8a30778288d5c28cfcfdc8811153b9ef192da7e65f6614432d37e1898cd8b7a3

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

characters/yuri.chr
Size

22KB
MD5

9067e14776f57d96e4ae582838cf8282
SHA1

54c48cea142ce0ad4c427b878ef3555943711ac2
SHA256

61b8d1033218e3b1deaeeb6931b1605805f6f236887e60e3e4116648c8af1e4a
SHA512

08d4ea8590d0b0b5516a61117e863be47a14f69ec582f5c362f87abae1c0bef5ef2e3ce965b02c9455f4cdcbd049fb43a385d5bad30e513463ab550cd3a7290c
SSDEEP

384:0iwks450ZfeepAk0ZNI2fy45tz7WeMt+cxCtyjeavHjiVYpbFGXP878miNfhT:0/jVSk0JfyqNWeP2CtyiwjAibkk7IfR

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2652	AcroRd32.exe
2652	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2592	2792	cmd.exe	29
PID 2792 wrote to memory of 2592	2792	cmd.exe	29
PID 2792 wrote to memory of 2592	2792	cmd.exe	29
PID 2592 wrote to memory of 2652	2592	rundll32.exe	30
PID 2592 wrote to memory of 2652	2592	rundll32.exe	30
PID 2592 wrote to memory of 2652	2592	rundll32.exe	30
PID 2592 wrote to memory of 2652	2592	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\characters\yuri.chr
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\characters\yuri.chr
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\characters\yuri.chr"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fa1ba92b3d494873076d7e83c8820c6e

SHA1
1050de6f30e2da7a0670f8dec846bc80011c0362

SHA256
f0412acb1c6add29b3b7d6090c7b1d9a668e4a49bb9208fb3a8f2addf555b936

SHA512
717ca04d70d0233f94d96b9e9f76ad50bb752185cf4253b72430d4f46c2d018948dd9ab1cf24305f516c42df20cc98372e012ab57c465d03705018f554139fcb

Download Submit