85d84da597bba6a36e1f89b137e843a09b4022515b9bd51a53a39a97b1325826

Analysis

max time kernel
151s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04/08/2023, 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Upload/admin/modules/tools/recount_rebuild.php
Size

23KB
MD5

61d415d9eb0e65cea7fd2712a271baa9
SHA1

b9a257e5ab4bc26bfd90f66443bc3cb1f711e1a6
SHA256

a69b79eea54e8d79f160694642367038381e624e8e988448ec3addb1773c3e4d
SHA512

ff969d21358c79fc17acf8fe1b457af1c1f8cb8f49375cb8512c47bd5b0cf28b142f3fd7f4ac58413027bb23a009bc7d28e08bde7a2d2a34ece0a7bd212cfff5
SSDEEP

384:1ZoFIv2gm+5aBwdy3kMG1R51sgntg//jipog6o+:1ZoFIZ5bykMmrNUM/6/

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\php_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.php	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.php\ = "php_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\php_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\php_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\php_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\php_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\php_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2992	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2988	2092	cmd.exe	29
PID 2092 wrote to memory of 2988	2092	cmd.exe	29
PID 2092 wrote to memory of 2988	2092	cmd.exe	29
PID 2988 wrote to memory of 2992	2988	rundll32.exe	30
PID 2988 wrote to memory of 2992	2988	rundll32.exe	30
PID 2988 wrote to memory of 2992	2988	rundll32.exe	30
PID 2988 wrote to memory of 2992	2988	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Upload\admin\modules\tools\recount_rebuild.php
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Upload\admin\modules\tools\recount_rebuild.php
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Upload\admin\modules\tools\recount_rebuild.php"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c30d7c6085112b34bd0c8a701468dfd2

SHA1
55e4f6703546fca8f5578b38296459e29d2cd08f

SHA256
7b6a3f4b12a373aae0326d727dcc9854e4436081ca377d3527ce974fa3bc5299

SHA512
43306a5c84db78c209d731ff099e33babb199412492c790c4cc07ff45aff8e907facbdb22d4aa66f678d3a3f3ac9b08cb18e450294610c693b28075ac6590085

Download Submit