4294d49908162674476fddacb2ea23608e0b3fef5ca6a54042d1c2ff91ddf6b6

Analysis

max time kernel
192s
max time network
159s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

frag.sh
Size

311B
MD5

39a2a58656f8ac24d12f82476df61562
SHA1

06d6ace208906e2fece26fd7c36d21fde0f206e4
SHA256

639e466fcfabf86510a16c91d8cc2671d1555d8b18b46d0f77d28ad9cb7287a9
SHA512

5873a8650d5a7e9500a7574120d2aa07b5a23cfb41e894f2a4aa82c3c3a8da1e6f06067220b97dab3b09c29741f2910940595083d3a8061f0e01e40aa431d76b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\sh_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\sh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\.sh	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\sh_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2580	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2580	AcroRd32.exe
2580	AcroRd32.exe
2580	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2680	2748	cmd.exe	30
PID 2748 wrote to memory of 2680	2748	cmd.exe	30
PID 2748 wrote to memory of 2680	2748	cmd.exe	30
PID 2680 wrote to memory of 2580	2680	rundll32.exe	31
PID 2680 wrote to memory of 2580	2680	rundll32.exe	31
PID 2680 wrote to memory of 2580	2680	rundll32.exe	31
PID 2680 wrote to memory of 2580	2680	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\frag.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\frag.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\frag.sh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d7b5a54b49e2d8a71e7162299cfe8c71

SHA1
171a0b2df00c146aede78ee23294c708763de31f

SHA256
71dd59d8bec0c7d91dc77779f6d1d6180d85105e84cdf74f47e9e3c06501738a

SHA512
4ccdf41ff2d374676c4b589f0c52f0870c987ede5328142677928e48af395f86837613f101cecab2bdeb4d47336e199db04926950f8e7f898e79073310ceb993

Download Submit