843d5892ae16569f2b69899a9b344c4d8a36d441591006c9075c497a3bf7af20

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29-08-2023 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zSusrzSlibzSnode_moduleszScorepackzSdistzSpnpm.js.map
Size

229B
MD5

6ffe5990ee52a759022cf3e99e4595a7
SHA1

dfa7ea8d52675af49a56a3f66a4203b39970ced8
SHA256

6e4c7d0f7510c8c2938dbbc014edef3100b076a7076fbd79487d015368150960
SHA512

a2add73fd79a33f087a7892178a5bb4a2e77a6d1c380e37cc07a89380ca9de6f9b5c4fad7522ce8571990e1869ad633e7d36b578cfce3a713fc4b33c44ed19a7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\map_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\map_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.map\ = "map_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\map_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\map_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.map	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\map_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\map_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2756	AcroRd32.exe
2756	AcroRd32.exe
2756	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2856	3032	cmd.exe	29
PID 3032 wrote to memory of 2856	3032	cmd.exe	29
PID 3032 wrote to memory of 2856	3032	cmd.exe	29
PID 2856 wrote to memory of 2756	2856	rundll32.exe	30
PID 2856 wrote to memory of 2756	2856	rundll32.exe	30
PID 2856 wrote to memory of 2756	2856	rundll32.exe	30
PID 2856 wrote to memory of 2756	2856	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tmp\v8-compile-cache-1000\11.3.244.8-node.10\zSusrzSlibzSnode_moduleszScorepackzSdistzSpnpm.js.map
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tmp\v8-compile-cache-1000\11.3.244.8-node.10\zSusrzSlibzSnode_moduleszScorepackzSdistzSpnpm.js.map
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tmp\v8-compile-cache-1000\11.3.244.8-node.10\zSusrzSlibzSnode_moduleszScorepackzSdistzSpnpm.js.map"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
28fb577eb17c6fd938b1969e895b1913

SHA1
86eac47a2653447cd5b0e5beb3b801db5161f654

SHA256
36bb1ea7fe96ae4160975d2cce4c84f0698293a6d9ab3fea8aa1719d1f25707d

SHA512
6b866b8a778ad3ecd58e9a27742b06b3899db6effe5092adbb772fd812091ee9593e1ad772f472250afaa88781dccced0635a6698da6c8cef8c27f820ca64bc8

Download Submit