cd3a4ec6176821a173d7c5354b05095f499392249f7a54fb116d059f9529dd63

Analysis

max time kernel
151s
max time network
68s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/12/2022, 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Photoshop CC/App/Photoshop/Required/Plug-ins/Generator/assets.generate/node_modules/svgobjectmodelgenerator/pre-commit.sh
Size

105B
MD5

3374cb754c67c424ea01f9923ecfe91b
SHA1

a393553bc6fa7b369889cda1b972af895c12d345
SHA256

3be15750dbfcf7af1869190bdea4917fa6a5323f44b8494deb1291ea6f92f621
SHA512

3d9739574c631c49c877aa7a80a731d8d6b2b999bd7bc0cec6feced46a3a5a55cd3735bccf7e8e64e7226aa86fd71ea47eef19b40a24d1542d540dca152647a4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.sh	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\sh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\sh_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\sh_auto_file	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1696	2016	cmd.exe	28
PID 2016 wrote to memory of 1696	2016	cmd.exe	28
PID 2016 wrote to memory of 1696	2016	cmd.exe	28
PID 1696 wrote to memory of 836	1696	rundll32.exe	29
PID 1696 wrote to memory of 836	1696	rundll32.exe	29
PID 1696 wrote to memory of 836	1696	rundll32.exe	29
PID 1696 wrote to memory of 836	1696	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Photoshop CC\App\Photoshop\Required\Plug-ins\Generator\assets.generate\node_modules\svgobjectmodelgenerator\pre-commit.sh"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Photoshop CC\App\Photoshop\Required\Plug-ins\Generator\assets.generate\node_modules\svgobjectmodelgenerator\pre-commit.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Photoshop CC\App\Photoshop\Required\Plug-ins\Generator\assets.generate\node_modules\svgobjectmodelgenerator\pre-commit.sh"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-82-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/2016-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download