5fcf334055fac13b19af791b8afeeae7146570ab704a03b96a70f8e3dd416ad5

Analysis

max time kernel
1210s
max time network
851s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02/08/2023, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

com.termux_118_src.tar.gz/.editorconfig
Size

442B
MD5

909fe2a1336905d40af03b886af94fc7
SHA1

35ff43dc602476b97b7a54f1fb4b2532bfb41f4d
SHA256

7ee28d82bb78e171c4dcb58ab11265f5429357bddf41ce99cf5daf0e519a0db2
SHA512

dfde9ea7ab78c34ad55ec745045290aa53a532916df8926cbfcf1e3f1209d5ae61538f4bea2c3130166004a6695dd20231a19e85eefff3b99ecc782dd68cda27

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\editorconfig_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\editorconfig_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\.editorconfig	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\.editorconfig\ = "editorconfig_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\editorconfig_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\editorconfig_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\editorconfig_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\editorconfig_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2340	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2340	AcroRd32.exe
2340	AcroRd32.exe
2340	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2084	2576	cmd.exe	31
PID 2576 wrote to memory of 2084	2576	cmd.exe	31
PID 2576 wrote to memory of 2084	2576	cmd.exe	31
PID 2084 wrote to memory of 2340	2084	rundll32.exe	32
PID 2084 wrote to memory of 2340	2084	rundll32.exe	32
PID 2084 wrote to memory of 2340	2084	rundll32.exe	32
PID 2084 wrote to memory of 2340	2084	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\com.termux_118_src.tar.gz\.editorconfig
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\com.termux_118_src.tar.gz\.editorconfig
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\com.termux_118_src.tar.gz\.editorconfig"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
30c8a5f1c595aff3f6fb6fc41590e2fe

SHA1
b3337e0fef945bc1fcf44a67c0a90b528deeb17c

SHA256
aa883f1466d30e36df2cb18ff275386cfdc1c4f1610c4dfe146596a58039fff5

SHA512
9912ca61186442c04f7857ad23be31dcd72bd0523776e75ace445308235288611351847b24c3c1f131af13abf52a5b1f8cb0f7de5a709ccab64ff7e669de3bad

Download Submit