9efec71ad7d777f31faec653a203b66a0ffce86e24cdd7e87ee9b14837cb89d2

Analysis

max time kernel
149s
max time network
125s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
29/10/2023, 08:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base_fragment.sh
Size

161B
MD5

5b293a8112b38e1222fd981265e12dd3
SHA1

a888f14ac2b39c90b68f194e3a69e0754f1a78fc
SHA256

0980057dba7e8a8d76f5137a5c69a6e9b08f8903cfb2c2921c603b9f1233c544
SHA512

606e6aa3bac1e39548e84d8f11f8e4ce23106ef0044b5f358f30b4f2a5b49ad5805464b804dfd19bfa34b37b76d1d5a8dd4223bab483cf5e9e953d387e69a4ec

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\sh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\.sh	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\sh_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\sh_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2704	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2704	AcroRd32.exe
2704	AcroRd32.exe
2704	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2776	2956	cmd.exe	29
PID 2956 wrote to memory of 2776	2956	cmd.exe	29
PID 2956 wrote to memory of 2776	2956	cmd.exe	29
PID 2776 wrote to memory of 2704	2776	rundll32.exe	30
PID 2776 wrote to memory of 2704	2776	rundll32.exe	30
PID 2776 wrote to memory of 2704	2776	rundll32.exe	30
PID 2776 wrote to memory of 2704	2776	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\base_fragment.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\base_fragment.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\base_fragment.sh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f5031691707dbb3c374a811c0889ca4e

SHA1
94dfdf56561b19709a9ebc73dfae9017cfe56be6

SHA256
b20d1dcec90a585319d596ffc1ea8587999f9d1a17738633c1b8a2cda4a95950

SHA512
65fe03c4ee1ba4e7fe9ac31b77a33d7c692c3f86c63360b18be3201f6e9979b2f039d26f42870ad5e7e773cf4c8ce234f06d9084bf21632a2a6028df031a5a13

Download Submit