13cd2a8679136e19284f04d6c3cdcd825562d35871f2b63b04e7dbbcc4ae4cc8

Analysis

max time kernel
207s
max time network
97s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vertex.sh
Size

1KB
MD5

8b1794b41fadf1bcadafba979d23b83e
SHA1

2b1d634d36316e86b60c68fde9a65856c47d0e57
SHA256

0a6c4b746128ed89c066cec16227deb7b56224bcfd65fe8aefbe9d1b8f21dfc3
SHA512

b26b18671b7f8d295486e59f158ae603b775113e96a7f65f50401d53af7093f6ce7308addaa613ee1d54e69b6668062432a9942cadf860a69c49db2f3b39c9ce

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\sh_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\sh_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\sh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\.sh	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2644	AcroRd32.exe
2644	AcroRd32.exe
2644	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2856	2364	cmd.exe	30
PID 2364 wrote to memory of 2856	2364	cmd.exe	30
PID 2364 wrote to memory of 2856	2364	cmd.exe	30
PID 2856 wrote to memory of 2644	2856	rundll32.exe	31
PID 2856 wrote to memory of 2644	2856	rundll32.exe	31
PID 2856 wrote to memory of 2644	2856	rundll32.exe	31
PID 2856 wrote to memory of 2644	2856	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\vertex.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\vertex.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\vertex.sh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
82e0d981cc64593016f11594762e5d9e

SHA1
943b76c66c1efa484c87476c33970f81f5b6e2f9

SHA256
f8ea6debc5d6b4406a162f14719ace60f1449e089f69e02de0fd03e242c589a2

SHA512
fa12e73f7dbfa2545d77255d8f2f89da90603b165559fd13c0c61babb915cd40046c39a630bb943100393ea11495ba38b3d96d91ba7b095bb4220d53143ef499

Download Submit