5e89c6325b0661bfaa205afe553b7280def9c209f4dde43e262237c19e8dbea3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data.bin
Size

385KB
MD5

94d7d9d8ff2e1f29e1ab7a906bbbf9c3
SHA1

4fd3485f3ce162f3b35a87ef7e7fcfd510546ee0
SHA256

2d83fb3f93c339ad34771c212586545dc3c7deb518ffde76411326fabf9725cf
SHA512

4ce02b4e56410f7ce069223187b2dffb7930d855dafa377df60c9b669f27002dd431f65bbc203130e5d88e2f060247e8b226ceae2b6f39082a58eb5c538ace0a
SSDEEP

6144:xYRfxtyDDTO5qwPAAy+/g+OPGUCl085ceyrXIP7KwqGfcaqersiMsj:eRyEFAAyMA4C4P+6US7Msj

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\bin_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\bin_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\bin_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.bin	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.bin\ = "bin_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\bin_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\bin_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2740 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2740 AcroRd32.exe
2740 AcroRd32.exe

pid	process
2740	AcroRd32.exe

pid	process
2740	AcroRd32.exe
2740	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1608 wrote to memory of 2612	1608	cmd.exe	rundll32.exe
PID 1608 wrote to memory of 2612	1608	cmd.exe	rundll32.exe
PID 1608 wrote to memory of 2612	1608	cmd.exe	rundll32.exe
PID 2612 wrote to memory of 2740	2612	rundll32.exe	AcroRd32.exe
PID 2612 wrote to memory of 2740	2612	rundll32.exe	AcroRd32.exe
PID 2612 wrote to memory of 2740	2612	rundll32.exe	AcroRd32.exe
PID 2612 wrote to memory of 2740	2612	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data.bin
1⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\data.bin
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2612

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\data.bin"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2740

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
3d6cce0de43cbd2f0c654482acfe20dd

SHA1
7c2c618b8e6041965261db30424f3b2eb1460bc7

SHA256
2b521ef2f77040357646d042d249cbac17b50ceba52a0b4d9ec94042fd4a508d

SHA512
af169d270ca3096bb6db99faf74a034327b6cfe763ba1538eee9eaadd1c3f28ff1760c7320668381c182e1496f5510d51227a43892cd08361fed4d877f9d0d38

Download Submit