b492a779314f8e5acadc326421167bd4ac3ed160d9ad85ce5bd02d71434caa00

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware Samples/3608a584e78a18b8281b7da7956c38dc.danger
Size

184KB
MD5

3608a584e78a18b8281b7da7956c38dc
SHA1

cbf7a13d17de6fd06bcb40e253bbde9275cdef9b
SHA256

b20ec4d553dbfbd429f250574d665236c74b3ee44c0e7b7d3d718dc7fed30cb6
SHA512

f7133f5d705f72520e680320c79f98c5f23e98d6840cf107aba816b627501e2ae76214c5a47e1a4c214780f30ebc03c00500a7734d74aec2aec3ca3706998cef
SSDEEP

3072:YT2y/GdyDktGDWLS0HZWD5w8K7Nk9uD7IBUypCI8LL9QZL+jzdDym/ANmMAmMoRy:YT2k4TtGiL3HJk9uD7bsCI8LL9QZL+jv

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2688	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2688	AcroRd32.exe
2688	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 1168	328	cmd.exe	31
PID 328 wrote to memory of 1168	328	cmd.exe	31
PID 328 wrote to memory of 1168	328	cmd.exe	31
PID 1168 wrote to memory of 2688	1168	rundll32.exe	33
PID 1168 wrote to memory of 2688	1168	rundll32.exe	33
PID 1168 wrote to memory of 2688	1168	rundll32.exe	33
PID 1168 wrote to memory of 2688	1168	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Malware Samples\3608a584e78a18b8281b7da7956c38dc.danger"
1⤵
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Malware Samples\3608a584e78a18b8281b7da7956c38dc.danger
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Malware Samples\3608a584e78a18b8281b7da7956c38dc.danger"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
90820e6d77712165c6edf0b4cf854f57

SHA1
8780855c258089a4442e81b965f2d8db4aa7ab35

SHA256
c970445db25bf7e5ff50752a58db98e1e526f8c0452fba9c6cf568e326beed60

SHA512
6fece007857c8b73815758ab9d75d0e12a944196e058e34ec1f73d68c8a9e8e76553406715777a03fa4e8aaef92cd2c04e9db737e0920cb07570ad7d31fde186

Download Submit