2a3669aebf4e3d0f217e8094cab6d9694fbcdcf53ea4941275cabcece8180fbd

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-01-2025 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

home/maciek/mimikatz/kiwi_passwords.yar
Size

2KB
MD5

21cb5b54ab42c19f66a10e839f789d64
SHA1

36cb221fad2de8af5abe28702c189d20afe5d141
SHA256

25b0c720edf459b98346692d52c094abc92bae6b9e1309b7ab6f11057d605e21
SHA512

042cb7c42588c7cf013061db95e68b035e51ec5d14701fc9e12a19e661de0e05564985650598c95c830c449553a5177b256fe9fc813447e2e6d506bad3748ff8

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2776	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2776	AcroRd32.exe
2776	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2224	2152	cmd.exe	32
PID 2152 wrote to memory of 2224	2152	cmd.exe	32
PID 2152 wrote to memory of 2224	2152	cmd.exe	32
PID 2224 wrote to memory of 2776	2224	rundll32.exe	33
PID 2224 wrote to memory of 2776	2224	rundll32.exe	33
PID 2224 wrote to memory of 2776	2224	rundll32.exe	33
PID 2224 wrote to memory of 2776	2224	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\home\maciek\mimikatz\kiwi_passwords.yar
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\home\maciek\mimikatz\kiwi_passwords.yar
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\home\maciek\mimikatz\kiwi_passwords.yar"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
759f687fb2a378c5ef597dc12a48d6fb

SHA1
a8ded22405c932595c88bfa109c16c12a14efe63

SHA256
05f6ec5ed64ed91c47baa45b182d0993aa421b0acb3b0843122a0dc62d66f435

SHA512
f7bc74f1c0f46ab3ca7126e7e765f045da1e6c63d881ebb554410ff66521b47e299d2475651bf3fdfb064d3a0170b961a2da53feb47e02d60aa4ac07e01697aa

Download Submit