4d63caee8d2c5e50ebb220e6aa593fe852a516e209006ba0a16507907125f46c

Analysis

max time kernel
163s
max time network
133s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boot.config
Size

183B
MD5

c304e51081727c9ccca00fd1b855bb27
SHA1

d80daa53c1f057ae755e7f970ec45a4c4fac1b18
SHA256

d2b49301986fae9cdf19f50fde45df7f86945f17c9e58fa06b03a89c16a400cf
SHA512

8e1d189277c0e6bfab6fcc17408578e0b4cd20fed47f089a5e08126ac64b88513821286a2461a61f551443714d7f8bdf5e4538dd4161ba90eadfd30995291972

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2620	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2620	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2620	AcroRd32.exe
2620	AcroRd32.exe
2620	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2620	2164	cmd.exe	28
PID 2164 wrote to memory of 2620	2164	cmd.exe	28
PID 2164 wrote to memory of 2620	2164	cmd.exe	28
PID 2164 wrote to memory of 2620	2164	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\boot.config
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\boot.config"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
32201ecd3c2e003707a1a7b1be25f432

SHA1
9dc2199682da64000fc1f47d98ec531e43e2c862

SHA256
3d636e2a6824c724565ce1ada7dbc76618ec94ebcf013bae3646dcbc9666106d

SHA512
cd4c88c950e5a15dd8b021a9f5441699f93a1176eee8ecff0d9700b23e3150b1681c444d24fa4659563d0b5e8e2e0f7bd9f8a6424dfde02d6142061f48fe5121

Download Submit