Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-11-2024 17:10
Behavioral task
behavioral1
Sample
nurikalfa.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
nurikalfa.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
4lena.pyc
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
4lena.pyc
Resource
win10v2004-20241007-en
General
-
Target
4lena.pyc
-
Size
5KB
-
MD5
90614b6050c242cc2d0f17ffc2a2491c
-
SHA1
2ea3d828b8f93969c10900ecb39a1397ea52fe86
-
SHA256
6623647edb682f33c5020283a3998e0e9393248945eb83fa389e9ecdfe4f943f
-
SHA512
addc3224fed2ee4ec5d675c52d1cb913f386e95f9dd5fba030338d0658fe00628065ba5d58fe56523118dd56fb00db45cd45ccc060b6ee5ad68147071cfc1680
-
SSDEEP
96:BhCHkbGk1h1eLHeuGWpn40dmfFskCYA8VZGBV6ZrIQu:GEik1vwHt7140d9kCYA8VZIVUrIj
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
Processes:
rundll32.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid Process 2824 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid Process 2824 AcroRd32.exe 2824 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid Process procid_target PID 2156 wrote to memory of 2056 2156 cmd.exe 31 PID 2156 wrote to memory of 2056 2156 cmd.exe 31 PID 2156 wrote to memory of 2056 2156 cmd.exe 31 PID 2056 wrote to memory of 2824 2056 rundll32.exe 33 PID 2056 wrote to memory of 2824 2056 rundll32.exe 33 PID 2056 wrote to memory of 2824 2056 rundll32.exe 33 PID 2056 wrote to memory of 2824 2056 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\4lena.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\4lena.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4lena.pyc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2824
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD59223c628f8739e0ac15e6a54f5f88bad
SHA14adb8a917e58839f8d99f508fa7aab147796f445
SHA256161e7f403eb8d75a7d7bd452e1c6c8365bf9c4aa2f513a3a9019954a93da51f5
SHA51201e5f7f665b1eecfc3097dc30d9870d9ccc69ecea7c4e3c5acfc88f33a7b718f700fad7136740aa3b68547f25137904de4d3e3f0bebe40bd2b5cbf3572033143