eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
290s
max time network
428s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-05-2023 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

trojan-leaks-main/gif.7z
Size

16.1MB
MD5

2a3740dd732e5d92554571ab007edd51
SHA1

334b5a49f1f428688aa3660c4c86465412ec1a10
SHA256

33ae704c2fe1e4f0e0457e200da15b9ccbb14d7651c92dd32dbfd434ecca26e2
SHA512

f64d5128c33b39fcb054b4165c867f3c2ec8aa9052618a1e49b0fda27f80dc0368a6d655152218f8d3c86d601435bc7f2753087b7ca76fc964009f5f581e396a
SSDEEP

393216:3jSKhdo9F6lgdAHq1iBk43RUvbuUs9XEIhtwtcRF8gAnvX:TbTsaq1ck48buVXEIhtTKvX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\7z_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\7z_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\7z_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.7z	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.7z\ = "7z_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\7z_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\7z_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\7z_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

1592 AcroRd32.exe
1592 AcroRd32.exe

pid	process
1592	AcroRd32.exe
1592	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 292 wrote to memory of 776	292	cmd.exe	rundll32.exe
PID 292 wrote to memory of 776	292	cmd.exe	rundll32.exe
PID 292 wrote to memory of 776	292	cmd.exe	rundll32.exe
PID 776 wrote to memory of 1592	776	rundll32.exe	AcroRd32.exe
PID 776 wrote to memory of 1592	776	rundll32.exe	AcroRd32.exe
PID 776 wrote to memory of 1592	776	rundll32.exe	AcroRd32.exe
PID 776 wrote to memory of 1592	776	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\gif.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:292
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\gif.7z
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\gif.7z"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads