7a8aee0ff7f0eb5c8eda7fecdad3616e44adf6da1cd89dac50ae7e322f9d9ce3

Resubmissions

10/11/2024, 07:05

241110-hwwpeavnhn9

10/11/2024, 07:04

241110-hv96easbml9

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/11/2024, 07:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New folder (4)/free robbux/ChromePass.cfg
Size 315B
Sample241110-hv96easbml
SHA256 f8bbdb15bb930ade0a5ede05a1c59a035acf9156e4ac3ed6e6f6266a4a283d64
MD5 71775bf8ae53af053d3b70c31d3784e1
SHA1 1b12d1fb8e42b7802703c316bfedefe2e7f6b311
SHA512 f9402e311e58bee5c9b085118ef6b0b93527b5d865077649f5b702e67f56c46c1ad4c2f12a0a9098feee2048574bbe8a8a6b2fb7940ae31ea810bdb23ae9791f
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2936	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2936	AcroRd32.exe
2936	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 3060	2160	cmd.exe	31
PID 2160 wrote to memory of 3060	2160	cmd.exe	31
PID 2160 wrote to memory of 3060	2160	cmd.exe	31
PID 3060 wrote to memory of 2936	3060	rundll32.exe	32
PID 3060 wrote to memory of 2936	3060	rundll32.exe	32
PID 3060 wrote to memory of 2936	3060	rundll32.exe	32
PID 3060 wrote to memory of 2936	3060	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\New folder (4)\free robbux\ChromePass.cfg"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\New folder (4)\free robbux\ChromePass.cfg
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\New folder (4)\free robbux\ChromePass.cfg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 8cd481e126d7e5d08b4a6d36125d6c7b69c66a0a2297035cda6a714f68391827
MD5 e3c63a5b1b4ef5f63dff80fc35f1616e
SHA1 9d43bfe2885b229e0dc324203db38a612050157f
SHA512 b4ca665694afce6e4d1210df0c6900d58fc2f83e8060a54f529a212117cb167042d9de9c95f08de5fb11fa87500816a783fb89255425f984fee8e4f5e976f86f
MD5 SHA1 SHA512

Submit Download