8e7391f55642f8b52e8c20afb4007a7df1a85215a12660cff88590b4cc631420

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x64/031.phpt
Size

565B
MD5

03744b04fa52a70b8fd2cb07cdc31246
SHA1

118c61628b9769e65ef07f0c1567a23849d4ba7b
SHA256

5e77b8f2dfaadebaf41a3051f99edbca27e80fff9853116a96d3e5913397570c
SHA512

b50837b4e44fcf3fbea9e59452fdea604235cacc7d04e6af534a3d68c1fcb8a13e91a976bda1f2c545f980b2eff8567155aa79fa5cd63d704b73fa873693ad68

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2860	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2860	AcroRd32.exe
2860	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 2316	320	cmd.exe	32
PID 320 wrote to memory of 2316	320	cmd.exe	32
PID 320 wrote to memory of 2316	320	cmd.exe	32
PID 2316 wrote to memory of 2860	2316	rundll32.exe	33
PID 2316 wrote to memory of 2860	2316	rundll32.exe	33
PID 2316 wrote to memory of 2860	2316	rundll32.exe	33
PID 2316 wrote to memory of 2860	2316	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x64\031.phpt
1⤵
- Suspicious use of WriteProcessMemory
PID:320
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\x64\031.phpt
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\x64\031.phpt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b227fcced687a36577d605d80943ca41

SHA1
bc2b1933d931b40553a6fa7ec5f411c3c8c36e79

SHA256
737bb8564d6dfa439ce1d6eba0ba0712467610f914d41d839b38884b441cdc6c

SHA512
40eac93c59b6782d91fb1c6514d47638624ece5575e8706ddf7ea9a9227dca6658e4a4a97bbb107f6a957cb1bc5e58b44a7e4129c8886fd1cb0db8c9b1a0a2ad

Download Submit