9f3a43ab58c24e5394021009092be2d3ecff413aa57a440542e3b2a827fd9b54

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/12/2024, 21:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vacuum_Nanostructuring_Marton.doc.lockbit
Size 45KB
Sample241202-zz2hhasqev
SHA256 af0821ba5e0889e21f6246c7f33d89caf320a5452e620d28d39948fde3ea20ac
MD5 b68e1ca5f7e24a344ca9262b4a8c34ca
SHA1 11cb6e8a38dd26b00f6503debfbb52f97a0d6024
SHA512 0233f6b9128c93bf545ba2d48b9df676ca02b90da929c63c3b509e4140d4089bcff1d0c428816c88c5a3b06fe5249193e23e8b00d3bee164d791c770d1b6aef8
SSDEEP 768:ivXzZXd+7MopNlHCgKldths98e0ao8WL3E5MSCjLI29OZBZ4kBaYp5:2zld+Jpcl1Q8eBWL3S4LiZBvBaI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2012	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2012	AcroRd32.exe
2012	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 1168	328	cmd.exe	31
PID 328 wrote to memory of 1168	328	cmd.exe	31
PID 328 wrote to memory of 1168	328	cmd.exe	31
PID 1168 wrote to memory of 2012	1168	rundll32.exe	33
PID 1168 wrote to memory of 2012	1168	rundll32.exe	33
PID 1168 wrote to memory of 2012	1168	rundll32.exe	33
PID 1168 wrote to memory of 2012	1168	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Vacuum_Nanostructuring_Marton.doc.lockbit
1⤵
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Vacuum_Nanostructuring_Marton.doc.lockbit
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Vacuum_Nanostructuring_Marton.doc.lockbit"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 1021f53be2f9cfee8430fdb1e1bdccfdc3c10c8ed0c9dc8e45b071daa09edf3f
MD5 6278ee096967275b78e6f987d1675715
SHA1 dfac5031488e57664644e6c835bdc4fc0fcb4805
SHA512 a917497a2f81fe997be45595f67477b026236388dc434ef94834b1ae333b8bce98b5fbe19b26c53c2564f185a301da1e5e058668d6ca8888df8e7c20567d21fb
MD5 SHA1 SHA512

Submit Download