eb19dd67fdae4ca09fd29f17308a4fb82a29d314b7e067bc5d4119e8b1ae914f

Analysis

max time kernel
262s
max time network
294s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AIMi - AI Aimbot/nvidia docker/debian/changelog.old
Size

2KB
MD5

4da80c1fe153c705629c3f6993493065
SHA1

1d60515364e7113c30b21e0a477588b11957d80a
SHA256

49fa7866059085bb09dae9405d9a7aa6936cdd4d19fcf44a619741dd9cefc08b
SHA512

ba01c8dbac366f06e29f529d6ec60fa464a936c694017cadfb49baaa0e8b8011ecb891e4caffcd7d9bb47074596b59c0f048eea248fe86602b1a56cd57c40444

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\old_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\old_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\old_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\.old	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\.old\ = "old_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\old_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\old_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\old_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2364	2828	cmd.exe	29
PID 2828 wrote to memory of 2364	2828	cmd.exe	29
PID 2828 wrote to memory of 2364	2828	cmd.exe	29
PID 2364 wrote to memory of 2588	2364	rundll32.exe	30
PID 2364 wrote to memory of 2588	2364	rundll32.exe	30
PID 2364 wrote to memory of 2588	2364	rundll32.exe	30
PID 2364 wrote to memory of 2588	2364	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\AIMi - AI Aimbot\nvidia docker\debian\changelog.old"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AIMi - AI Aimbot\nvidia docker\debian\changelog.old
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AIMi - AI Aimbot\nvidia docker\debian\changelog.old"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3b5332ffbb102bb8e1d29115b27f491f

SHA1
9b06a49a5460f16973d758193d2231370e597e5a

SHA256
4ba27593b94b88da99e8ca12b3b1822ef2b41cf185fd9c2a10c3618c3a917fb1

SHA512
dd81b83af137185a4b625b36b1fd77d6d229fb8a3faaa863c3973f463bd0cf95680953691095063514f8f10a306d191c2dd9bc29f9d47834c775ccfb3837defc

Download Submit