5fcf334055fac13b19af791b8afeeae7146570ab704a03b96a70f8e3dd416ad5

Analysis

max time kernel
1200s
max time network
847s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02/08/2023, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

com.termux_118_src.tar.gz/.github/workflows/debug_build.yml
Size

4KB
MD5

c5f568d3eb0c774e97b05603cc514d9f
SHA1

241c8b28c877ff0cb45df996beabaa38472c058e
SHA256

6e3cf3df168cbd156491814dd16e2d653ebab577539a99adcefd4f6e28df2897
SHA512

1bcd3a649200aaf928cf7dfacd68593cb034b67d42d4b751eb2b5a583f1621bb12e98e0c2ab92cb086e1d57275a98440879fe7fe95add95ede6266db5c4e5348
SSDEEP

96:eHbaHCDKbhbZQrN6zyzhHUpt14Jp5ESkckcBC6LEY6vUUC03dgE9pXSv+X:e7M04BEHrOS8y7A7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\.yml\ = "yml_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\yml_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\yml_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\yml_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\yml_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\yml_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\yml_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\.yml	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2936	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2936	AcroRd32.exe
2936	AcroRd32.exe
2936	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2068	1900	cmd.exe	29
PID 1900 wrote to memory of 2068	1900	cmd.exe	29
PID 1900 wrote to memory of 2068	1900	cmd.exe	29
PID 2068 wrote to memory of 2936	2068	rundll32.exe	30
PID 2068 wrote to memory of 2936	2068	rundll32.exe	30
PID 2068 wrote to memory of 2936	2068	rundll32.exe	30
PID 2068 wrote to memory of 2936	2068	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\com.termux_118_src.tar.gz\.github\workflows\debug_build.yml
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\com.termux_118_src.tar.gz\.github\workflows\debug_build.yml
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\com.termux_118_src.tar.gz\.github\workflows\debug_build.yml"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
76d3e6978aa858d271a9b12dfca20abf

SHA1
41adf8ba5ebfd3d8828006d64e55b65686dcd2cf

SHA256
c53b6b941366e7df20ad81147df10ff0217a1a803d1156499b4815431771845c

SHA512
00e703753f2306338fb1fb54052b418d4bad6d45f2dd2c513e493e3b72915c638aa24095a036a17c8c42357663920c45593034b025d6b0315ed6e55f80c1cb66

Download Submit