6be4d25bd90b841fd9693a567f1983de0d1c4155a62ee066cf5f1837e75c1b06

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R B X 9 5/config.vdf
Size

14KB
MD5

bb23e26ed15c9951460513efdb0b7ac7
SHA1

41e15b1f30840160ea095f0f415ac3afd6d06968
SHA256

9fce8b4ac41455418615f2785199f72d7fe6ce39d8cd9182027a752c4f26d04a
SHA512

f3f3e7ef4765520554fcb523b43f448b28b29fbbf150657728084b720fca4568a23a3846f37f3c57b6710fdeb3761fecc190f468944ba1a687aad0e8f7af1093
SSDEEP

96:o9lCt/5KFdRBQ20LPr7U8Op3y47Zu/ZqaJOTFogkU:o9MtBKFdRBQ20LPr7U8OBlsRq8gkU

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\vdf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\vdf_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.vdf\ = "vdf_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\vdf_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\vdf_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.vdf	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\vdf_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\vdf_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2608 AcroRd32.exe
2608 AcroRd32.exe

pid	process
2608	AcroRd32.exe
2608	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1776 wrote to memory of 3052	1776	cmd.exe	rundll32.exe
PID 1776 wrote to memory of 3052	1776	cmd.exe	rundll32.exe
PID 1776 wrote to memory of 3052	1776	cmd.exe	rundll32.exe
PID 3052 wrote to memory of 2608	3052	rundll32.exe	AcroRd32.exe
PID 3052 wrote to memory of 2608	3052	rundll32.exe	AcroRd32.exe
PID 3052 wrote to memory of 2608	3052	rundll32.exe	AcroRd32.exe
PID 3052 wrote to memory of 2608	3052	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\R B X 9 5\config.vdf"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\R B X 9 5\config.vdf
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3052

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\R B X 9 5\config.vdf"
3⤵
- Suspicious use of SetWindowsHookEx
PID:2608

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
3a0641ef9eabd8f07658ab6e52e6a08e

SHA1
3c03397829a51042b9cbf9ed49523e1b63c83929

SHA256
27a250953521772937b570ac5d2e5f0e7a9107fadf03c83dc636f0d750234996

SHA512
e41a11ef5b9f60413cdf17417eb181ad89631ebf04fef189542e3b66bbdd29b721279aeefd6c69cbacf21f543bc90d63a6f7fd0335d3aa9d5e3e152e4b4cdc76

Download Submit