c23d5192d1f506769fd9dac2e17a43c99022fef48873e7887909c9a1704a5717

Analysis

max time kernel
151s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/09/2023, 21:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sys-diplom-main/config/node_exporter.service
Size

236B
MD5

3d9956b4f752c2b8d0ab2a0d768fbb87
SHA1

d35b6c4d4a483a7f83f0d38c8c331db688e7396c
SHA256

93fb990002400563bbdf437979e6969bc7fe0e257f6fe7c40882c42aa848a69e
SHA512

ce5146771f872625858f58a61dbca9566a7e50068def281903f80dc779160cb4b534282aafdec3f4762967160c0445df3fd3571f3beefd3210f87f957289895b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\service_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\service_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\service_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\.service	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\service_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\service_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\service_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\.service\ = "service_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2680	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2648	2836	cmd.exe	29
PID 2836 wrote to memory of 2648	2836	cmd.exe	29
PID 2836 wrote to memory of 2648	2836	cmd.exe	29
PID 2648 wrote to memory of 2680	2648	rundll32.exe	30
PID 2648 wrote to memory of 2680	2648	rundll32.exe	30
PID 2648 wrote to memory of 2680	2648	rundll32.exe	30
PID 2648 wrote to memory of 2680	2648	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sys-diplom-main\config\node_exporter.service
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\sys-diplom-main\config\node_exporter.service
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\sys-diplom-main\config\node_exporter.service"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1f8bcdf6cdb94eb004b0ede03623a567

SHA1
decd672b9891adceba0deb815bb100c2a362ab56

SHA256
6c9acbba7cb4c0ac8cf608aab22c24ba1758ef0ab290212701b8bdcfd8520dfb

SHA512
0a37de1848d545f248827b7e47ec57309fcf043ca2e83f9d7137dd2c969192c2faef25df502b1059d7680eccd8d0ee2e33b1ce4485c2a93af8c530d1aca2d711

Download Submit