a7d2ea641dbc8e50000e6b42c9cca200fa25d5e37ddd1857eb489795ab5564ee

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Beskikningers/temperatures.ref
Size

697KB
MD5

17df408e712c3359e4b58f95e4529f16
SHA1

75203c6b467a1174b41dfefe3795a9b87331808e
SHA256

35d50d71afa6b8169123458a8232cde1e3d96e3a0e6734045714192b0930d1aa
SHA512

7fa7600651ce103dd3f5143036e5ee6b5b3262555d331761bd426898990a6b314e25a018e4b16b395e86e0a023b24df3796744860e6478efbfa190ebadbc4253
SSDEEP

768:eLtWEAnNzz6fiBH4r4D2EBct2GaDNHpDe9SM1hon+wFniYgoZhgBy9:Q

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ref_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ref_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ref_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.ref	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.ref\ = "ref_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ref_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ref_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ref_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2612 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2612 AcroRd32.exe
2612 AcroRd32.exe

pid	process
2612	AcroRd32.exe

pid	process
2612	AcroRd32.exe
2612	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2080 wrote to memory of 2768	2080	cmd.exe	rundll32.exe
PID 2080 wrote to memory of 2768	2080	cmd.exe	rundll32.exe
PID 2080 wrote to memory of 2768	2080	cmd.exe	rundll32.exe
PID 2768 wrote to memory of 2612	2768	rundll32.exe	AcroRd32.exe
PID 2768 wrote to memory of 2612	2768	rundll32.exe	AcroRd32.exe
PID 2768 wrote to memory of 2612	2768	rundll32.exe	AcroRd32.exe
PID 2768 wrote to memory of 2612	2768	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Beskikningers\temperatures.ref
1⤵
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Beskikningers\temperatures.ref
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2768

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Beskikningers\temperatures.ref"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2612

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
8aacfe25b43743a3276b61ce5f0e3dbe

SHA1
1728d51eb7e0d782dcff93f4cde9c83596a9b062

SHA256
4d55b35826053ceb428c3595f624879cbb9502c811f965696644c1c2ce974b26

SHA512
9abc821aae684b7ca05e22249a81bea2b259fdc8dffd9301a2eebcb79637d0df1d9beadaa1704b81f404a922da5ff6c42b90a862532fb2f892de6250b67b25c7

Download Submit