843d5892ae16569f2b69899a9b344c4d8a36d441591006c9075c497a3bf7af20

Analysis

max time kernel
152s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29-08-2023 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zSusrzSlibzSnode_moduleszScorepackzSdistzSyarn.js.map
Size

238B
MD5

982b105c9da69be100c68cf3331f4b95
SHA1

db7e9b3e5f7c2daee3a7675564c1cb7dec8bb584
SHA256

f0c298c3d1718d366c4a64ba91d85753d735f6465d300eccc94c81089ae345ff
SHA512

3bc03910266e600d6eb6039551d65f0ed6d5c32d92a8caf7a671657a36222484de9805ec6f27624a713f087e07ed1c194a5fe110e09bdae4f2b1a42c5761b896

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\map_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.map\ = "map_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\map_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.map	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\map_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\map_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\map_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\map_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2928	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2928	AcroRd32.exe
2928	AcroRd32.exe
2928	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2448	2208	cmd.exe	29
PID 2208 wrote to memory of 2448	2208	cmd.exe	29
PID 2208 wrote to memory of 2448	2208	cmd.exe	29
PID 2448 wrote to memory of 2928	2448	rundll32.exe	30
PID 2448 wrote to memory of 2928	2448	rundll32.exe	30
PID 2448 wrote to memory of 2928	2448	rundll32.exe	30
PID 2448 wrote to memory of 2928	2448	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tmp\v8-compile-cache-1000\11.3.244.8-node.10\zSusrzSlibzSnode_moduleszScorepackzSdistzSyarn.js.map
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tmp\v8-compile-cache-1000\11.3.244.8-node.10\zSusrzSlibzSnode_moduleszScorepackzSdistzSyarn.js.map
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tmp\v8-compile-cache-1000\11.3.244.8-node.10\zSusrzSlibzSnode_moduleszScorepackzSdistzSyarn.js.map"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
01474ffc7b46685b480ac7d72964e485

SHA1
3ddca2c7798b4a90fafca4e41e464c89e451a0cc

SHA256
a3d9ed2858f40736a614332c3f618cb226d2ce637aba71b288a8ee6b1dcf82e8

SHA512
00ebd8fa00d0b7b5575b6c02b427849abbc61310b8a67b28c95525a98c323dcbef8d945541176eb1f7dca2654c84877bde1015bf6580bb6e3b873c438dfd7d2a

Download Submit