3ab51907d0c011d214b12e680e4bf1abda940d0c067336764fb5e09aa3ce0256

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-02-2025 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

config.yaml
Size

3KB
MD5

35e9ba6ba05d63fa3cf23f9dd218712c
SHA1

ab22b8cd23c175bee212f9a766f197a2738e6a72
SHA256

068a59d20fec3dc3b0d5bedf7f6a2c686d505dec16b8988198c9d5c47f5e3718
SHA512

298618a2933ccd381cfee84637c51b976d0a18507a06c7fe278f1a5da50c9235f870216f3f150bcf49c89c9afa7485ddb83a68273ff15cd7a6abbbf2dc7c9fd0

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2068	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2068	AcroRd32.exe
2068	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2840	2652	cmd.exe	31
PID 2652 wrote to memory of 2840	2652	cmd.exe	31
PID 2652 wrote to memory of 2840	2652	cmd.exe	31
PID 2840 wrote to memory of 2068	2840	rundll32.exe	32
PID 2840 wrote to memory of 2068	2840	rundll32.exe	32
PID 2840 wrote to memory of 2068	2840	rundll32.exe	32
PID 2840 wrote to memory of 2068	2840	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\config.yaml
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\config.yaml
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\config.yaml"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6b214e8e8f6670f7407dd4d9c4c9f051

SHA1
8c260db86bb68c4fd423b68bc2e2c2065179b243

SHA256
9245c2e83266044e32c9da6295478bdde819a6a16a818794388758904a43cdf8

SHA512
69184458fdba30a25898beae13282461d41a3427a683d62f4d40334529c667ea51f63acac6d8772d17c569278949ebc0b7714c33a99f014f528b9d30120ef238

Download Submit