bdbc35721238ef0c38acf962295c36bae59c6472b70bb469439c1c370ce472f6

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cve_2024_6387/exploit.py
Size

1KB
MD5

bdfe770350fccbb55fadf834fa52e4c5
SHA1

985109c80b184d59c19c83faf0bfe593524b8374
SHA256

1314fbdc8aa6153b27be3373b7cf83dbe0ad0d1dce853c466bf8372f2fe21936
SHA512

1ed063d25a295ae20f0182843339107112760fda99d7d1a2c3fef0fc73a411c689965558675f5100329649de7f8a4940e69e2255e2a5b70adb021f9bfe5cb7fa

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Modifies registry class 1 IoCs

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings rundll32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2768 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2768 AcroRd32.exe
2768 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe

pid	process
2768	AcroRd32.exe

pid	process
2768	AcroRd32.exe
2768	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 3024 wrote to memory of 2480	3024	cmd.exe	rundll32.exe
PID 3024 wrote to memory of 2480	3024	cmd.exe	rundll32.exe
PID 3024 wrote to memory of 2480	3024	cmd.exe	rundll32.exe
PID 2480 wrote to memory of 2768	2480	rundll32.exe	AcroRd32.exe
PID 2480 wrote to memory of 2768	2480	rundll32.exe	AcroRd32.exe
PID 2480 wrote to memory of 2768	2480	rundll32.exe	AcroRd32.exe
PID 2480 wrote to memory of 2768	2480	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cve_2024_6387\exploit.py
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cve_2024_6387\exploit.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cve_2024_6387\exploit.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
16459574e7568a6fadf09176382a271a

SHA1
782b1524e558a316cb72dc2c70f7b9e2c92ad5d9

SHA256
37c827419e0564fa311f6bfd5668350b72de7125d7a0ed7fee3fd2645608d133

SHA512
a62664708a55b208a46456c74248ffe95ce739462b0fcedf51698b721d6b8a0b53f61408ad0d4347b7fd226b52df459c6dd99dc6b95e3951489580fa291b5ef5

Download Submit