3e27f1673dfcd17dd02a8f738a709c42d5af736c045137aa90c6d781f189396c

Resubmissions

13-12-2024 22:03

241213-1ymhmazkaz 10

08-12-2022 19:39

221208-yc4hxaeb2t 10

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1316-61-0x0000000000220000-0x000000000025E000-memory.dmp
Size

248KB
MD5

89b97c08e0ab3b234e670aa5e9546ed4
SHA1

e9e24c146c375d6e95beabefa18a508e41084720
SHA256

3e27f1673dfcd17dd02a8f738a709c42d5af736c045137aa90c6d781f189396c
SHA512

64182672c1eebd597413ecec0cb3fdfcfd1c0a5ef168eaa795615c4c91078f40d9e4f58c91a5bb376136ae27ab5ac53c7a36115b3d8561388f9aeb0a3defb1b2
SSDEEP

6144:RBizIWRzBlSIiLaliSMrf5ujpmzqae5LiS:RasaxMNujpcqae4S

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2852	AcroRd32.exe
2852	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 2732	576	cmd.exe	32
PID 576 wrote to memory of 2732	576	cmd.exe	32
PID 576 wrote to memory of 2732	576	cmd.exe	32
PID 2732 wrote to memory of 2852	2732	rundll32.exe	33
PID 2732 wrote to memory of 2852	2732	rundll32.exe	33
PID 2732 wrote to memory of 2852	2732	rundll32.exe	33
PID 2732 wrote to memory of 2852	2732	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1316-61-0x0000000000220000-0x000000000025E000-memory.dmp
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\1316-61-0x0000000000220000-0x000000000025E000-memory.dmp
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1316-61-0x0000000000220000-0x000000000025E000-memory.dmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
464897bd91d62dfaaebaa5811b5da313

SHA1
5c07bd49f40b046171e74f35aacdf993db2b2423

SHA256
dc62c6e364ca0a45a3a9d74b5d59e2a96d8b353f502e0702ccf300d57e1c72a3

SHA512
c73aa37c5e997c70a1bcdfc0290e7756adc111701656d00766d0cc853a48b904662fc3ccc6699f4457bdada9fd3d05b55117a58a9885aa753473f1f91db1f59b

Download Submit