314166f9dde25b13c5cca86e65a67b26dbae5dcf17dccf7c5a5eb21d3ff76316

Analysis

max time kernel
103s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-10-2024 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

G K M 9 5/ai.cfg
Size

44B
MD5

73ed0e22c8cc70ed93dfd0c1b8f81e19
SHA1

f16c87ca3eb393ee34f57fb59781cd37f5963db0
SHA256

db9ec7ae21d140904d44d6e6550c0c964e32ef11c055696b355835905c9c3a53
SHA512

3dbe1fd660c7446c4a70c99cf6bf7909c76cd02ca24930bdeee851da094850b2fd6f6742025d215ce7dbf3348225c0b64d28e3f1ba133bdd9c7beece84d7e54f

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2920	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2920	AcroRd32.exe
2920	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 3004	2596	cmd.exe	30
PID 2596 wrote to memory of 3004	2596	cmd.exe	30
PID 2596 wrote to memory of 3004	2596	cmd.exe	30
PID 3004 wrote to memory of 2920	3004	rundll32.exe	31
PID 3004 wrote to memory of 2920	3004	rundll32.exe	31
PID 3004 wrote to memory of 2920	3004	rundll32.exe	31
PID 3004 wrote to memory of 2920	3004	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\G K M 9 5\ai.cfg"
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\G K M 9 5\ai.cfg
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\G K M 9 5\ai.cfg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c4604d4589c80b2170164d5704a3dd28

SHA1
5a9f5ae9bd79fb2999961d04bb3d19f2e555d1f8

SHA256
59b7893b592942d7dcd48c5376844676430f78394f71b00f71d0ad795aedf8d4

SHA512
a1cbdc4ecd99f36ffd0156d74f2a08467ca617c0ae2684b1309ab2837857cd54ca856f4157e3d111dcee841244a35f1c2ae283a1fef8dc60bbf691915a2b552b

Download Submit