Analysis
-
max time kernel
18s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 18:05
Behavioral task
behavioral1
Sample
stub.wim
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
stub.wim
Resource
win10v2004-20250314-en
General
-
Target
stub.wim
-
Size
23KB
-
MD5
ca9e55c46ef083cc7d041ca0e73cf40b
-
SHA1
61bc48a6b6d5dc6686ab55dff330bdaf2c7d3dfb
-
SHA256
ff8f3124fc3990644d9f509b33e109992d081ccbfac24cba880680f58587a6ff
-
SHA512
e772ae58c00af74d6f3e47e22f969e52a46da9aecc16ad5bf5315cea1979ab0d110bb95baa8d6e650bec60c9d7e2a70373b9d5178b2b311a6e5946ee9e157a36
-
SSDEEP
384:K3MLWHn3kIeoLF4+BlpFD4+CTJVr91CzEbLLe6Ym:On3kIhe+7pN4+6Vr9iEbfe6Ym
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2776 AcroRd32.exe 2776 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 524 wrote to memory of 2760 524 cmd.exe 32 PID 524 wrote to memory of 2760 524 cmd.exe 32 PID 524 wrote to memory of 2760 524 cmd.exe 32 PID 2760 wrote to memory of 2776 2760 rundll32.exe 33 PID 2760 wrote to memory of 2776 2760 rundll32.exe 33 PID 2760 wrote to memory of 2776 2760 rundll32.exe 33 PID 2760 wrote to memory of 2776 2760 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\stub.wim1⤵
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\stub.wim2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\stub.wim"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2776
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50273e48c662376ad5f3915787d8d6e85
SHA1c0a229c789a2ffb0a8140940b7a12dc66ca73678
SHA2567b8688c66b7a0b4d882f9502c24d6bfd4e70240224edbee13f4813697e7d1eb4
SHA5125f09491e1a6a2fd31f12dfc22108b8253dc4aeec2fca68817c24db0543e3989c1548ee9e2009f9473fc374d2040990a1448e88ba8862a57b1aaeb77af58b2f10