1252c59f28ed87f9236af0b045978c17351faf34649e639b1dc8fdfdd5ccc0ae

Analysis

max time kernel
311s
max time network
319s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-10-2024 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Installation Guide/README.md
Size

496B
MD5

9461a7e1bebab36162e2afd2263a5bc8
SHA1

a77ba243c10588c4428f3f372b82191839ec5acf
SHA256

41ee272268648deba3d883c3f6caa429c140135cf3f6d6194664f86159ff9381
SHA512

0909a0e510feac4478a711191afe6f82c24c515889646f880cfc51d34c19d5e58f351f1363afb1625e172f87c67c9093f6a6645460209a4a212e530443d26243

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2776	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2776	AcroRd32.exe
2776	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2896	2124	cmd.exe	31
PID 2124 wrote to memory of 2896	2124	cmd.exe	31
PID 2124 wrote to memory of 2896	2124	cmd.exe	31
PID 2896 wrote to memory of 2776	2896	rundll32.exe	32
PID 2896 wrote to memory of 2776	2896	rundll32.exe	32
PID 2896 wrote to memory of 2776	2896	rundll32.exe	32
PID 2896 wrote to memory of 2776	2896	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Installation Guide\README.md"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Installation Guide\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Installation Guide\README.md"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
83cb9c90beb4a936881d528bc856b3b6

SHA1
103de51cdc2444369c5a819f1c247666500a29a9

SHA256
25a4b844d3f845db26e342c9df51702144e24904d5215686bc0d435cfd08fe2c

SHA512
0e88012c4875620b6e507fad861ae235f4f667546b80e84e65b32a923975f60c1602a10f61c318478640985ae292c560550446b7669f0413e8348ab3f82e8a3e

Download Submit