650880b1ce23cd5339011a06388fa5e2be9eb74c21b65f46efcd8bb5ca8cb8bc

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Item/item_banana.dds
Size

16KB
MD5

2981f23cd75730f92f7d6d52cf9b5f0b
SHA1

dedaa127b465094938ac600f0b6f5d7103c21306
SHA256

07b39a4316ae8c067186fec554fdc2a95bf5d90a60b29236c49d8c45ac647c86
SHA512

4bccf548c2fd178516db7e978a9ada459af0f53a88013c9ccf83a94053fadefe1de35ed0fd536a38e54a38cdaa0595bfb917b492d9531e9e1a629eea33bed6b6
SSDEEP

384:Ia2r4jYPS39iaZOelSGn1QUglF861o0M3+qBDODIWQiO5wZHs1UToaLhkm:AcjD0aI7lRodK1ZHs1Woaem

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2788	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2788	AcroRd32.exe
2788	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2740	2000	cmd.exe	32
PID 2000 wrote to memory of 2740	2000	cmd.exe	32
PID 2000 wrote to memory of 2740	2000	cmd.exe	32
PID 2740 wrote to memory of 2788	2740	rundll32.exe	33
PID 2740 wrote to memory of 2788	2740	rundll32.exe	33
PID 2740 wrote to memory of 2788	2740	rundll32.exe	33
PID 2740 wrote to memory of 2788	2740	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Item\item_banana.dds
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Item\item_banana.dds
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Item\item_banana.dds"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7da478a86bd37310f0c9307ff02a9550

SHA1
1ab658c3719332212e87235d68af947cb0afc0c2

SHA256
f8248d2b34fdab756420690de034feb829a20bcbbe450ef496f9ad7fe5cbeeed

SHA512
a8a65f69bcfd0d1ffe83300b772137796431524e73efeb5efd27aade0ab0998ad35b5ed0fc254ee4fb21db9a32655b8edb984daab0068156d6f7c8eb2636db56

Download Submit