8e7391f55642f8b52e8c20afb4007a7df1a85215a12660cff88590b4cc631420

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x64/bin/bug77691.phpt
Size

357B
MD5

70f8e80f20ff322f837a8e57558810b3
SHA1

94db455bdf11958019669758a887328ccd42f14e
SHA256

9610de94e4eadea444069f59b91d0ebd326f5c3e6148bb2a10af4165b19dd707
SHA512

74ab7e104cf441ff02ad1791fa5e9ef77ddead073ed0fd4fca91b97490a0959fd5ecfe3e1d949e2065f8ce0d733dd5631b5baf6504eb60c58bcd6dcab07e9f6d

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2704	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2704	AcroRd32.exe
2704	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2812	2076	cmd.exe	31
PID 2076 wrote to memory of 2812	2076	cmd.exe	31
PID 2076 wrote to memory of 2812	2076	cmd.exe	31
PID 2812 wrote to memory of 2704	2812	rundll32.exe	32
PID 2812 wrote to memory of 2704	2812	rundll32.exe	32
PID 2812 wrote to memory of 2704	2812	rundll32.exe	32
PID 2812 wrote to memory of 2704	2812	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x64\bin\bug77691.phpt
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\x64\bin\bug77691.phpt
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\x64\bin\bug77691.phpt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e4046731c7a11631ec346e8730926776

SHA1
7810eae7f869aa774fcab07cd3db082661f11ce4

SHA256
8b6d0daac732d3b6f1e4f0878b8a3ba2db00d7bd2b456f62d64a00bbeafa9cb3

SHA512
4df75f1ac593f9a5c0a343c6d8e9011390e3f5f1099c87ab6c380ac5726e6531682e5ad15fd1aec1aef21bf72de8605b7a7b1e9e545d75848d3628863106e70e

Download Submit