eb19dd67fdae4ca09fd29f17308a4fb82a29d314b7e067bc5d4119e8b1ae914f

Analysis

max time kernel
154s
max time network
138s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AIMi - AI Aimbot/nvidia docker/debian/nvidia-docker2.lintian-overrides
Size

56B
MD5

f48d47190efed38d32a13454e445c71c
SHA1

fc814a32dc60b3701f07db69fd133f21722ca730
SHA256

721dee40266d3349a570217fe09aef4fb0f5d44c4657875ccd4266c41764e87d
SHA512

33c1dacc6572e7deb72f781322a31f1572051bfc148263817c3fcb7ab7080540afb6952919472ca6f43e19ca1629586923b6d15dddc16915bd4756c766792ce0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\lintian-overrides_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\lintian-overrides_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\lintian-overrides_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\lintian-overrides_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\lintian-overrides_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\lintian-overrides_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.lintian-overrides	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.lintian-overrides\ = "lintian-overrides_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2656	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2656	AcroRd32.exe
2656	AcroRd32.exe
2656	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2740	2188	cmd.exe	29
PID 2188 wrote to memory of 2740	2188	cmd.exe	29
PID 2188 wrote to memory of 2740	2188	cmd.exe	29
PID 2740 wrote to memory of 2656	2740	rundll32.exe	32
PID 2740 wrote to memory of 2656	2740	rundll32.exe	32
PID 2740 wrote to memory of 2656	2740	rundll32.exe	32
PID 2740 wrote to memory of 2656	2740	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\AIMi - AI Aimbot\nvidia docker\debian\nvidia-docker2.lintian-overrides"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AIMi - AI Aimbot\nvidia docker\debian\nvidia-docker2.lintian-overrides
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AIMi - AI Aimbot\nvidia docker\debian\nvidia-docker2.lintian-overrides"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
32a29a0c25db9571183fe296eb0d80f0

SHA1
b376454ed2703b87af55ecaad0eb4fdb2b262753

SHA256
e7f0c23f41ccee72d5046c4d1b2116e93327cecaf7df06400a246bbafdf965f1

SHA512
333ca9352e0f4e900e2c514e510d4641227cc536b8b74ba5dc9fae8016d0b914bef450e7c5accdcf303c1e0b77187fdc5fa85698a43b06552a7c6c68aedbebac

Download Submit