Overview
overview
10Static
static
3a7d2ea641d...ee.exe
windows7-x64
10a7d2ea641d...ee.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Absorbable.sul
windows7-x64
3Absorbable.sul
windows10-2004-x64
3Beskikning...ed.vin
windows7-x64
3Beskikning...ed.vin
windows10-2004-x64
3Beskikning...17.vgr
windows7-x64
3Beskikning...17.vgr
windows10-2004-x64
3Beskikning...ls.scr
windows7-x64
Beskikning...ls.scr
windows10-2004-x64
Beskikning...el.txt
windows7-x64
1Beskikning...el.txt
windows10-2004-x64
1Beskikning...et.ser
windows7-x64
3Beskikning...et.ser
windows10-2004-x64
3Beskikning...es.ref
windows7-x64
3Beskikning...es.ref
windows10-2004-x64
3Besttelsestropper.hov
windows7-x64
3Besttelsestropper.hov
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 13:35
Static task
static1
Behavioral task
behavioral1
Sample
a7d2ea641dbc8e50000e6b42c9cca200fa25d5e37ddd1857eb489795ab5564ee.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a7d2ea641dbc8e50000e6b42c9cca200fa25d5e37ddd1857eb489795ab5564ee.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
Absorbable.sul
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
Absorbable.sul
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Beskikningers/Misaimed.vin
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Beskikningers/Misaimed.vin
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Beskikningers/Randon17.vgr
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
Beskikningers/Randon17.vgr
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
Beskikningers/keelhauls.scr
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Beskikningers/keelhauls.scr
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Beskikningers/primaveksel.txt
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
Beskikningers/primaveksel.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Beskikningers/skohornet.ser
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
Beskikningers/skohornet.ser
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Beskikningers/temperatures.ref
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Beskikningers/temperatures.ref
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
Besttelsestropper.hov
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
Besttelsestropper.hov
Resource
win10v2004-20240508-en
General
-
Target
Beskikningers/Randon17.vgr
-
Size
1.0MB
-
MD5
7978bf27082616faade55b22394bbddc
-
SHA1
3cb41f03b1cd775f7f6bc9b95944854dda87bf36
-
SHA256
b88a13eb0eedb9be6e1f809d0b8a55979186db208858fedce5a59b28556b248b
-
SHA512
9a734b8285c96706c434aedf2abf6666e82ec257defab74213c50b18a5c7b23b3a48d76fe64e4cc6446cc460095cea3f37d8029fa28b9198f4a371ba1c23922b
-
SSDEEP
768:DfIbQMnX/cgMWndUtQ//KuGQ+4xRoQoezjVn20Ka17J6T0vbXHtPSeySgSJSejnK:VIbm
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\vgr_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.vgr\ = "vgr_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\vgr_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\vgr_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\vgr_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\vgr_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.vgr rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\vgr_auto_file\shell\Read rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2628 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2628 AcroRd32.exe 2628 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2944 wrote to memory of 2688 2944 cmd.exe rundll32.exe PID 2944 wrote to memory of 2688 2944 cmd.exe rundll32.exe PID 2944 wrote to memory of 2688 2944 cmd.exe rundll32.exe PID 2688 wrote to memory of 2628 2688 rundll32.exe AcroRd32.exe PID 2688 wrote to memory of 2628 2688 rundll32.exe AcroRd32.exe PID 2688 wrote to memory of 2628 2688 rundll32.exe AcroRd32.exe PID 2688 wrote to memory of 2628 2688 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Beskikningers\Randon17.vgr1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Beskikningers\Randon17.vgr2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Beskikningers\Randon17.vgr"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5bc482bf57b73bfb980eed9ecad4b0c31
SHA14b1f6f9242c2a78f2789822ed6b396a3ca0d6aa9
SHA2560ec053636a9d4362cd923eaf43e3578f147f7b201a7997c6b6d67c32406b4ef3
SHA51223c30d9bc1e7027fda4db441ca0a4314e6e3529d4cdfbc65210c02a8ffc921282f97868ecf23af6399d06a165937411552c08d64cefe47b16a4ef1a6cfc546e3