5fcf334055fac13b19af791b8afeeae7146570ab704a03b96a70f8e3dd416ad5

Analysis

max time kernel
1200s
max time network
851s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02-08-2023 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

com.termux_118_src.tar.gz/.github/ISSUE_TEMPLATE/config.yml
Size

184B
MD5

84cc583d281e4ff10cb2bac69e98978b
SHA1

87379bef325e14d4f49ce48c201487a85d8d9ef6
SHA256

a4c1497dde418fc6cff15b5a55669ceea423ed283b8621b9e8e0773f98f9b34f
SHA512

4e01ef4e496348c45fff4bfa17a07ce0d23c60a2052d6a5d91caab8d6d3e41f5ce05098df57e6ef5bd672ee7416e314bf084c708ef4fe7b6cbff51af41bb1883

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\yml_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\yml_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\yml_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\yml_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.yml	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.yml\ = "yml_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\yml_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\yml_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2952	2248	cmd.exe	29
PID 2248 wrote to memory of 2952	2248	cmd.exe	29
PID 2248 wrote to memory of 2952	2248	cmd.exe	29
PID 2952 wrote to memory of 2588	2952	rundll32.exe	30
PID 2952 wrote to memory of 2588	2952	rundll32.exe	30
PID 2952 wrote to memory of 2588	2952	rundll32.exe	30
PID 2952 wrote to memory of 2588	2952	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\com.termux_118_src.tar.gz\.github\ISSUE_TEMPLATE\config.yml
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\com.termux_118_src.tar.gz\.github\ISSUE_TEMPLATE\config.yml
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\com.termux_118_src.tar.gz\.github\ISSUE_TEMPLATE\config.yml"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4f8b80d3c80e955ffe26a7813f60c21f

SHA1
a5d699ed954c5d6e0728c9d451b4226759e02aac

SHA256
27d4e9a3959f8401617401d3dc4e96fd51962d32a4486f265a27303b61e1b77d

SHA512
7ebe591cbc7670b914e3390676b2b0e35e35c1a75134d5057101095b25138130efc8663d444f44bb761cbef89d27c3ffea93e9306b525d8d168806d6c143bba3

Download Submit