6fa8356f35968afc15ecb036d17e197dfc310fcd5a42fa952183bd4b5a37fc36

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28-12-2024 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TeddyPcFiles/config.json
Size

99B
MD5

668a1b746e7bce9ff92bcf04fecb2014
SHA1

83d39ef8457d8c03c7e2dff8db688833fe4eb495
SHA256

c5ed2b2dcbda5dc58f8c1ad7652f0c7e0432d5900683b798b72970065817cdb8
SHA512

2b11a3f36223088b203ceae4d1207f1100a6cbb44556e235f82dc4c5ea0d32798800a3b41b99f57e6a30d9a47d773f0bb1b4ca62dff8c9a00be87afbdc3a1208

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2656	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2656	AcroRd32.exe
2656	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2640	2124	cmd.exe	32
PID 2124 wrote to memory of 2640	2124	cmd.exe	32
PID 2124 wrote to memory of 2640	2124	cmd.exe	32
PID 2640 wrote to memory of 2656	2640	rundll32.exe	33
PID 2640 wrote to memory of 2656	2640	rundll32.exe	33
PID 2640 wrote to memory of 2656	2640	rundll32.exe	33
PID 2640 wrote to memory of 2656	2640	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\config.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\config.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\config.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bbdb162c3a76324af6ac9ffbf1e4f9a8

SHA1
7f980a5ca462d186c062bf0786ec5ff6017bc747

SHA256
545a4ce61b4381ac51ec4ca9e6ef46c25b8c749c661616ddca2d5e542f596c6a

SHA512
252aef9708e088e166de3793db70147c1895928255060bd8763fc326eaba6c672c34f8f246f2802380111e08f24d12bb8149b67ddad98fb07d55b31501c2b8a6

Download Submit