385267a11cc318a791e7a74bf78f673ebbaec9fbec431f2dd796ffbdbb18a350

Resubmissions

21-11-2024 12:22

241121-pkaq5awqbk 3

21-11-2024 12:19

241121-phbkmsskdw 3

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

citra-windows-msvc-20240927-608383e\README.md
Size

7B
MD5

d44763f941cf001b7c45853bcd10b53c
SHA1

54e4def114b091e3b121b1594eb1813408cada9e
SHA256

7b7f485176737ada837b0097eb9f04b52ef3bcbbaa7968f69734dab825e790d9
SHA512

df1f43625014625ba92861793525ab4d25a0c0981b4c9939d9dca1068b7f5f02556d778ef020d2b8eb44e2e3924949818d5098e8c88a65e537fd948422c68346

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2712	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2712	AcroRd32.exe
2712	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2676	1788	cmd.exe	31
PID 1788 wrote to memory of 2676	1788	cmd.exe	31
PID 1788 wrote to memory of 2676	1788	cmd.exe	31
PID 2676 wrote to memory of 2712	2676	rundll32.exe	33
PID 2676 wrote to memory of 2712	2676	rundll32.exe	33
PID 2676 wrote to memory of 2712	2676	rundll32.exe	33
PID 2676 wrote to memory of 2712	2676	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\citra-windows-msvc-20240927-608383e\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\citra-windows-msvc-20240927-608383e\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\citra-windows-msvc-20240927-608383e\README.md"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
13b7ab943be7db219258c104683053c3

SHA1
cea4c9bf076aee6ab3eb1bf8a1a31108d21ad26c

SHA256
914bc629ad0fa3c5bb571d2c48aa79a366ecba4bb50054122f7c27e854403743

SHA512
edf6f97bcf109f3c82315d558afe52d2dcc0d7bf71b7d39a2308065d3e412f5846dc42e21302adfd804672be7d439a23b04b03b90373139e1be003a6f344557a

Download Submit