5fcf334055fac13b19af791b8afeeae7146570ab704a03b96a70f8e3dd416ad5

Analysis

max time kernel
1200s
max time network
841s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02/08/2023, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

com.termux_118_src.tar.gz/.github/ISSUE_TEMPLATE/02-feature-request.yml
Size

552B
MD5

31e114ca11b0ebe281f75d489f88e18e
SHA1

46c0f1fa6b756c72039c25e1a38e792c634a7c5f
SHA256

862c966b268fbb808089402d9b36eb4f038ff507c9ae198249ff95de37b5ef95
SHA512

c1bb22f29b4bee72a3c62d23e07ca5b6ae25301c24a1c333180ffa5222b39bb1f99b810f30b7f2ca4eae878a4a0e0ef576dda4242819b9f9f5fc8629668a6dec

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\yml_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.yml	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\yml_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\yml_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\yml_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\yml_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.yml\ = "yml_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\yml_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2128	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2128	AcroRd32.exe
2128	AcroRd32.exe
2128	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2140	2184	cmd.exe	29
PID 2184 wrote to memory of 2140	2184	cmd.exe	29
PID 2184 wrote to memory of 2140	2184	cmd.exe	29
PID 2140 wrote to memory of 2128	2140	rundll32.exe	30
PID 2140 wrote to memory of 2128	2140	rundll32.exe	30
PID 2140 wrote to memory of 2128	2140	rundll32.exe	30
PID 2140 wrote to memory of 2128	2140	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\com.termux_118_src.tar.gz\.github\ISSUE_TEMPLATE\02-feature-request.yml
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\com.termux_118_src.tar.gz\.github\ISSUE_TEMPLATE\02-feature-request.yml
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\com.termux_118_src.tar.gz\.github\ISSUE_TEMPLATE\02-feature-request.yml"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3a5505ae41a9fe6f71547d255b82e07d

SHA1
fb630d141e217835088ccd4b576a86e06ac7f6f0

SHA256
f21ec3d2385d06e035d276f004963d734a8917847445ce64225979137b3a759a

SHA512
26d2e1fd070835ede77776f9d4a50ac1f9c5caf30a111bd688af8e7338f274ff100f0f5619ea6990d618b3d6e71f96dbc37beb27c4ffafe1de913ee2790306a1

Download Submit