85d84da597bba6a36e1f89b137e843a09b4022515b9bd51a53a39a97b1325826

Analysis

max time kernel
152s
max time network
130s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04/08/2023, 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Upload/admin/modules/tools/php_info.php
Size

974B
MD5

2bb3c7755ffdd71c7b4528bdbf0c9d0d
SHA1

98c095a44e5feaf802c4bc342f79b2576f3c58e3
SHA256

5da0cc50a808a7405a948b22bde1ed3a82095b25b908b552aeb41ae164c90111
SHA512

e8f2132965b1556f82d1e92adce1434b97313ddc9b905d1c6f74ca9519c3257e6dc2e07bab015ea86e0bd6f5f7cf50c7a2abdb3edd5ecb7a2e9e71519947394b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\.php\ = "php_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\php_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\php_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\php_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\php_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\php_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\.php	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\php_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2924	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1692	2044	cmd.exe	29
PID 2044 wrote to memory of 1692	2044	cmd.exe	29
PID 2044 wrote to memory of 1692	2044	cmd.exe	29
PID 1692 wrote to memory of 2924	1692	rundll32.exe	30
PID 1692 wrote to memory of 2924	1692	rundll32.exe	30
PID 1692 wrote to memory of 2924	1692	rundll32.exe	30
PID 1692 wrote to memory of 2924	1692	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Upload\admin\modules\tools\php_info.php
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Upload\admin\modules\tools\php_info.php
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Upload\admin\modules\tools\php_info.php"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d8c0baa8c7d8c5524f40b602401d8572

SHA1
54958d3a047a3cd6adf6631cbacd29fc8904a407

SHA256
d921aa9e392f10a18840953969c70ef6a99ef962f75e7ded8bb35cdf683202f7

SHA512
d9badeefaf5db16c2bfee3a6de77f691bac949496ec9d0cdca659325cacce2d48170f168f88d70843b7f1bbce176e016fcfdfb843319c942451d77cc2949192b

Download Submit