6bc581da7fc4ac59f1ef1c819943925d892726da0005be5ad75c3ad2a5cf4c44

Analysis

max time kernel
284s
max time network
318s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

frag.sh
Size

311B
MD5

39a2a58656f8ac24d12f82476df61562
SHA1

06d6ace208906e2fece26fd7c36d21fde0f206e4
SHA256

639e466fcfabf86510a16c91d8cc2671d1555d8b18b46d0f77d28ad9cb7287a9
SHA512

5873a8650d5a7e9500a7574120d2aa07b5a23cfb41e894f2a4aa82c3c3a8da1e6f06067220b97dab3b09c29741f2910940595083d3a8061f0e01e40aa431d76b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\sh_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\sh_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\sh_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\.sh	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2560	2656	cmd.exe	28
PID 2656 wrote to memory of 2560	2656	cmd.exe	28
PID 2656 wrote to memory of 2560	2656	cmd.exe	28
PID 2560 wrote to memory of 2564	2560	rundll32.exe	29
PID 2560 wrote to memory of 2564	2560	rundll32.exe	29
PID 2560 wrote to memory of 2564	2560	rundll32.exe	29
PID 2560 wrote to memory of 2564	2560	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\frag.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\frag.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\frag.sh"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bc2b64335ce2939eef92d3886d2e2088

SHA1
73fa12d49f1f58cfcce83db9404cd31e8a1ce4c3

SHA256
6f547b0423742a1d1304c4e5d311898e6ff187bc0c13daf4e9a473fa8401945c

SHA512
51041bd99e6e487b4272b5bbc00ee85f5b35bb254c835bc23e09a4bfdc73ea5723edf9b7c994f55f9fe966cf41b39ff8f0c3b0c25b0599c40c15d0d5e3baae8a

Download Submit