ac0f683632e27a7ea2f6ee14c27e76073881842ed81cc6b961ac1f274515360a

Analysis

max time kernel
155s
max time network
129s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
10/07/2023, 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sploot/Sploot/Sploot/config/keyframes.cfg
Size

25KB
MD5

ba02495faf5fb4cd7d659a093b240040
SHA1

dbf3e17b0444e49b0b5932aace7736a4dd2ca25b
SHA256

f311a3b188c844211f81d7dc483189ec458b7a81bd1e27fa970acca471adac5d
SHA512

e3232b61e60e2a8df16a1db6c869fdb8afa51713d8bb5a04e82e8e06bde61606dfe444a10916930cd7c7b9f15f14f35adaba5feafe2f9cc7d258aafeb849f7bf
SSDEEP

192:UTmTqTtTCTcTkT4TjT1TbTqTkTWTOTwT5T7T/ToTtTMT1TNTAT3T3TcTmTETnkTu:3m1RMqVlS

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\cfg_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\cfg_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\cfg_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\cfg_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\cfg_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.cfg	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.cfg\ = "cfg_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\cfg_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2072	AcroRd32.exe
2072	AcroRd32.exe
2072	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2440	2496	cmd.exe	29
PID 2496 wrote to memory of 2440	2496	cmd.exe	29
PID 2496 wrote to memory of 2440	2496	cmd.exe	29
PID 2440 wrote to memory of 2072	2440	rundll32.exe	30
PID 2440 wrote to memory of 2072	2440	rundll32.exe	30
PID 2440 wrote to memory of 2072	2440	rundll32.exe	30
PID 2440 wrote to memory of 2072	2440	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Sploot\Sploot\Sploot\config\keyframes.cfg
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Sploot\Sploot\Sploot\config\keyframes.cfg
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Sploot\Sploot\Sploot\config\keyframes.cfg"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
246f0775552072e6aa83ceddafbf0b47

SHA1
0ad7266c330d0022c57a460f96de99c5c9e7152e

SHA256
274dc2cfb6827f5e8522b3f7f6a752cd4e8b0f5dc602af7a5d2dd7ec80784326

SHA512
b01ffcb3a497f7392356072a87355a1d8aa216df36fe181f56bee32108f460366e9a3c0e5ed6756e12519b0d08a5a15bffff11ee1ba711483533e5879cf28b16

Download Submit