ca5a0e2963dc959524712f6d71b937d20a2bf15a4fece708ede9a84b50bb2ebf

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
14-11-2024 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Myomectomy.und
Size

72KB
MD5

ef1b436f4a2cb4f3dcc5b90c1fc1e3b7
SHA1

5e7751303869e1b5be0b5329e358d587838ec72d
SHA256

e44d99f5ed408fde60776bc82f30c9ebd9f1dad717cd5d050e9e58070b8af9f6
SHA512

344208d055522ee3c65383967f7f27b037e3a9af430a535897942a275c5e6f0af41e99c5a749ce1ac4cea5b2a61fbb1c1b15267973ce9c0d3eabc8fac4373d9d
SSDEEP

1536:+NdXwLaPniOJM5o7fuyl3B+izWxRJCYdhWyevmERoc4a3v1/DnJZUlE1:mdXwLX5YVlLzWxRIYdhkmEuRa3v9DbUk

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2876	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2876	AcroRd32.exe
2876	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2392	2616	cmd.exe	31
PID 2616 wrote to memory of 2392	2616	cmd.exe	31
PID 2616 wrote to memory of 2392	2616	cmd.exe	31
PID 2392 wrote to memory of 2876	2392	rundll32.exe	33
PID 2392 wrote to memory of 2876	2392	rundll32.exe	33
PID 2392 wrote to memory of 2876	2392	rundll32.exe	33
PID 2392 wrote to memory of 2876	2392	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Myomectomy.und
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Myomectomy.und
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Myomectomy.und"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0b90fd91de3ae1ac7144300a6521c8c2

SHA1
98401997a3f6b73c5f4c24f6451b749733931477

SHA256
6733b6d6869fccdd344d0b5cf298f4ea588d7b7bfc807b52ea26b40303c5b64c

SHA512
ebf934122fed4470863f268ab2fa51cf9aede096c773a329cf8a78089b7e9352a73306ba383d000858a10de41f6078e0a7800fa67daf759b73979f963639c835

Download Submit