1517b2cad778c2f60c3e175797fbe180f9d869aad4b4ec22ea4e619c4f87ef63

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-01-2025 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Udlaansbetingelser.sme
Size

352KB
MD5

365192963e84961bb4ad8095785fc17a
SHA1

2fd4a5e63cf6176cbdb3decc6dff9a1b8fd8d649
SHA256

e4475458e2580de7bf379f70dbd69edd2424fef1e155bce84a1bda16d70230b3
SHA512

c39a3e96cbdc4356dfd4ba9e30b078a3c8960268225e548b0e60beebff8f76d8f5e2df5dd2799d1cd4d8862967d15ef5d53a4122edacae4148be28c8bfa2855f
SSDEEP

6144:3FcLlptzsbGain+wfRcmnovR+p2PymfLHzsv9BwRbky:qLRLXnRcSX8amfLHuBCky

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2336	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2336	AcroRd32.exe
2336	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2620	2624	cmd.exe	31
PID 2624 wrote to memory of 2620	2624	cmd.exe	31
PID 2624 wrote to memory of 2620	2624	cmd.exe	31
PID 2620 wrote to memory of 2336	2620	rundll32.exe	32
PID 2620 wrote to memory of 2336	2620	rundll32.exe	32
PID 2620 wrote to memory of 2336	2620	rundll32.exe	32
PID 2620 wrote to memory of 2336	2620	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Udlaansbetingelser.sme
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Udlaansbetingelser.sme
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Udlaansbetingelser.sme"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b989a503fd6ae804065e4f5dffb305be

SHA1
ed7449fc3e92e172b862710875e37cb735fc37f2

SHA256
70e2861688c9bb985fca381d4a18da49b28f7b1522590493af97032c8ae578bd

SHA512
6a7667764fc179e69240bfba646d12279bd8f8ba9973ec4bd79f677d1aba832d238ab6f2c44de09a1e0b496b83fd8950cb74fcc875e8c8a1d8767d1ab6f2c65c

Download Submit