66a32b79ff2c15ac32dd147b9509c1d0b8fb0e24f91f478352fb9564d45416f8

Resubmissions

06-08-2023 19:58

230806-yps8psde2y 7

Analysis

max time kernel
151s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06-08-2023 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02_JumpRulesOneControl.md
Size

691B
MD5

ec17f6bfe15c0f471bd770dfe9866ff0
SHA1

466dc5f6dc7731ea921263d6ce7d534ae66d24d5
SHA256

7d393c80eff2086ab1b5a44cd2187d1bc9514852f3b0790479bca8d726a36c03
SHA512

ec0a7275ba7fa59447db49e44d56018379248e16dd550a76c6f181065f5fabf5f897b5f7b7810d9c29c3d72f7a81dc2c3b2ce902969991fa8bb08ea9ca9fc958

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\md_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.md	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\md_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\md_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2892	AcroRd32.exe
2892	AcroRd32.exe
2892	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2904	2028	cmd.exe	29
PID 2028 wrote to memory of 2904	2028	cmd.exe	29
PID 2028 wrote to memory of 2904	2028	cmd.exe	29
PID 2904 wrote to memory of 2892	2904	rundll32.exe	30
PID 2904 wrote to memory of 2892	2904	rundll32.exe	30
PID 2904 wrote to memory of 2892	2904	rundll32.exe	30
PID 2904 wrote to memory of 2892	2904	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\02_JumpRulesOneControl.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\02_JumpRulesOneControl.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\02_JumpRulesOneControl.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4e0eda261abea749567a1bac9eed049f

SHA1
1645bcf2655d12ab0e5ea07fe11cdb7f1d557c54

SHA256
ba5e5643041e94e88cb1580ddaafe89cc559104ba81f1a5ddce37dfe040beab6

SHA512
bcf2014eb383ba3b2dc9a188c9a02f3ccf3527cee5efea25c2e896a10e7e62870992eebcd7280eb1458b7242f425b876cc809ef3a57e37b7a4d060d6495a4d7a

Download Submit