d35d02cba96bd5cb9ef8e1eaa50a86eeb9e00cb5e345309471e8c28251efc125

Analysis

max time kernel
205s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mask_vertex.sh
Size

274B
MD5

106fc3540ca688b3f2f0a0018f321a64
SHA1

01f09b8eb07536696c8301924310aefa14d69395
SHA256

d087f2f4bc4840c8067bee22b11788d00d3c0d6f3099244cebe3105aa1503261
SHA512

e79c16f9bd30ca47c792829f523925dd5f9e784be9a64460e0a5e2d67fda45a467702745984c6ede5d73320fc9932086c948dcd45af8952ad8f89dc94375bb9e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\sh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\.sh	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\sh_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\sh_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2664	AcroRd32.exe
2664	AcroRd32.exe
2664	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2504	3036	cmd.exe	30
PID 3036 wrote to memory of 2504	3036	cmd.exe	30
PID 3036 wrote to memory of 2504	3036	cmd.exe	30
PID 2504 wrote to memory of 2664	2504	rundll32.exe	31
PID 2504 wrote to memory of 2664	2504	rundll32.exe	31
PID 2504 wrote to memory of 2664	2504	rundll32.exe	31
PID 2504 wrote to memory of 2664	2504	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mask_vertex.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\mask_vertex.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\mask_vertex.sh"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4451829117a2de35cc94bdcb9e6b79c4

SHA1
1015db2eab627a5e9de34709e21e393b88d886fa

SHA256
7fed8b7f0c8825a4839b95404f07679b35dfe67d7395c40b4d2bded2044bc11b

SHA512
940ab3c6ebc3b3c826dc6a138d5c07d5fbcad1958de0d25d591d3b81e20d6402ff9594c2709c2e099effb6983fb8d16c20f54d92ffdb427598144e5937181bcf

Download Submit