843d5892ae16569f2b69899a9b344c4d8a36d441591006c9075c497a3bf7af20

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29-08-2023 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zShomezSmrkdzS.cachezSnodezScorepackzSyarnzS1.22.19zSbinzSyarn.js.map
Size

114B
MD5

cba138fedfa99d447f0f59de928963ea
SHA1

f2ec26094ce33c45f4981d925f6487bc558bd09b
SHA256

796e0058bccfa1a253c402824a01daa3d4591da7c48c3761c1715ec76e956b45
SHA512

c2e24c6baf1b34c582de69a82e8587797b45e9402eb184e47f4ec147be9161c1ac40275faa9fe4db72349908b810868689ecb5bae5b464ed01724a6e093bcc14

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.map	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\map_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\map_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\map_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\map_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\map_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\map_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.map\ = "map_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2144	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2144	AcroRd32.exe
2144	AcroRd32.exe
2144	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2988	2456	cmd.exe	29
PID 2456 wrote to memory of 2988	2456	cmd.exe	29
PID 2456 wrote to memory of 2988	2456	cmd.exe	29
PID 2988 wrote to memory of 2144	2988	rundll32.exe	30
PID 2988 wrote to memory of 2144	2988	rundll32.exe	30
PID 2988 wrote to memory of 2144	2988	rundll32.exe	30
PID 2988 wrote to memory of 2144	2988	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tmp\v8-compile-cache-1000\11.3.244.8-node.10\zShomezSmrkdzS.cachezSnodezScorepackzSyarnzS1.22.19zSbinzSyarn.js.map
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tmp\v8-compile-cache-1000\11.3.244.8-node.10\zShomezSmrkdzS.cachezSnodezScorepackzSyarnzS1.22.19zSbinzSyarn.js.map
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tmp\v8-compile-cache-1000\11.3.244.8-node.10\zShomezSmrkdzS.cachezSnodezScorepackzSyarnzS1.22.19zSbinzSyarn.js.map"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a4b1eb1546b60e67ace52a856942397d

SHA1
0542c2256f632e0870c7690471bd94c42aa279c0

SHA256
fe8de51f11783f6625de995083aadc8491e532b563989c583662fa903a77e308

SHA512
f619f607b5b0eaec146dd03c08ae4013ec4f4c77bfc78da374ea49b775a7fdff9251247ee6f600df39ec503c6bb5b0c1a95af17cec67fb90b7dcf651d571e104

Download Submit