b492a779314f8e5acadc326421167bd4ac3ed160d9ad85ce5bd02d71434caa00

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware Samples/53cbbf08fc5a6fb17799813e483efedc.danger
Size

189KB
MD5

53cbbf08fc5a6fb17799813e483efedc
SHA1

9a5c635740a31eb7c03083ca279965c6cf640467
SHA256

4f82bde52d13908fd77884ed0beefe2ed2bb9246a4f06255a46c8257cf78fffe
SHA512

411c3de3d346c3ae9a86a608ac6449ed5fb4bd4a1ed0dbb1613872715e93ade73f7f4ef390aa4ff086e9ff4600df4d4ed95d8955490e3e2ec9ca722b61644556
SSDEEP

3072:8J92y/Gdy7ktGDWLS0HZWD5w8K7Nk9JD7IBUTndHx/SvYp+Ke:I92k4LtGiL3HJk9JD7bTnnSQp+h

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2392	AcroRd32.exe
2392	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 1248	2556	cmd.exe	31
PID 2556 wrote to memory of 1248	2556	cmd.exe	31
PID 2556 wrote to memory of 1248	2556	cmd.exe	31
PID 1248 wrote to memory of 2392	1248	rundll32.exe	32
PID 1248 wrote to memory of 2392	1248	rundll32.exe	32
PID 1248 wrote to memory of 2392	1248	rundll32.exe	32
PID 1248 wrote to memory of 2392	1248	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Malware Samples\53cbbf08fc5a6fb17799813e483efedc.danger"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Malware Samples\53cbbf08fc5a6fb17799813e483efedc.danger
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Malware Samples\53cbbf08fc5a6fb17799813e483efedc.danger"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a5c237e8e739c8f51316c48992566e1d

SHA1
18b6840a5a3ee9cfc789612180010ff6e7d58b3d

SHA256
f110b43ce21084d096af4f04d4a25819a4f12011673802f9569bae0d8f4945e3

SHA512
214bdedad57eca7167824f58a317ece22fabfc7eb95cd3a86bb1e75116dfc52c7b5db9a43951d1253e35ff966a7b7c8ba4b58b88d9f7e385ff2e35bb45c208ff

Download Submit