c23d5192d1f506769fd9dac2e17a43c99022fef48873e7887909c9a1704a5717

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/09/2023, 21:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sys-diplom-main/config/README.md
Size

15B
MD5

4d153c6791b4576d5642b42e16593653
SHA1

f713768b49d57f2b0448ad07c020e8dc75d439d4
SHA256

897bf69d5551ab3718a828d7ce6831b69f363dd2bb362655800f71eb1df09773
SHA512

05105a59b41a4ad2ed63aed51c13e521450a7f5e642eb2df1ad14c095e5e7922b0ab0457460171193d17131796b2cdd7b962896d8b85501eaf431df5b6e9e539

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\md_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\.md	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2768	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2768	AcroRd32.exe
2768	AcroRd32.exe
2768	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2720	2076	cmd.exe	29
PID 2076 wrote to memory of 2720	2076	cmd.exe	29
PID 2076 wrote to memory of 2720	2076	cmd.exe	29
PID 2720 wrote to memory of 2768	2720	rundll32.exe	30
PID 2720 wrote to memory of 2768	2720	rundll32.exe	30
PID 2720 wrote to memory of 2768	2720	rundll32.exe	30
PID 2720 wrote to memory of 2768	2720	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sys-diplom-main\config\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\sys-diplom-main\config\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\sys-diplom-main\config\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ca237060ef3f2412c1cf384a789c1e41

SHA1
5976458d864e9241c0d2634217a16fda271fa0a0

SHA256
7cd0c8e9ae5e64ae4019678db096060b02bc734e4d2fff4808d7be6ea586297d

SHA512
714b08daf0b21ff893b2d361454862ff69df89f917180e9ebb060128a36657a6700616f8c9f3d83b321a0095fd612f6cbdbe2c7c15f5752a22a7f1e66032bbf1

Download Submit