61859a2460b667071ecd47bb30206247afc972d6a02f5932d827057734347133

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25-07-2023 11:01

Target

newhotmail/hotmail/index.php
Size

3KB
MD5

f54751eec298e805b3ccd9b3ffc90e9e
SHA1

df0d8ae8e7ff5776e325487225037c5c5bf43d9a
SHA256

c4dc16b0e276114f874bf36f55d123dcb1156509036a6d11ca45a0f9dbf49b49
SHA512

2bc3bfb01a906605e14950187454f8941b66864a9748781e824be7f940b78589a8622493baceddaaefda630e14a251404da90ecdd6987dd39d4647b929879632

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\php_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.php\ = "php_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\php_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\php_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\php_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\php_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.php	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\php_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2828 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2828 AcroRd32.exe
2828 AcroRd32.exe
2828 AcroRd32.exe

pid	process
2828	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 3000 wrote to memory of 2948	3000	cmd.exe	rundll32.exe
PID 3000 wrote to memory of 2948	3000	cmd.exe	rundll32.exe
PID 3000 wrote to memory of 2948	3000	cmd.exe	rundll32.exe
PID 2948 wrote to memory of 2828	2948	rundll32.exe	AcroRd32.exe
PID 2948 wrote to memory of 2828	2948	rundll32.exe	AcroRd32.exe
PID 2948 wrote to memory of 2828	2948	rundll32.exe	AcroRd32.exe
PID 2948 wrote to memory of 2828	2948	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\newhotmail\hotmail\index.php
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\newhotmail\hotmail\index.php
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\newhotmail\hotmail\index.php"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2828

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c0b942a78cfd36e5e7488c5cf7963a69

SHA1
83357990b0b11e05ab896d7f203b716e3ab33a07

SHA256
dc19995fd8aa8630d00e6601c8d3483f6568d311bfcfd7d8d7a26edba6197866

SHA512
69a68dbea44e2fc3f0786319b1f3e74b4a318fdefa6fcb15ab1f6efa3379f609981824d2c0d2a9427cf1dcafed2799b2ddb341e1406a4b0253ec3104e95a3bbe

Download Submit