ab9db6dba660472c6d0109993d7c9f070a899016fdf15c4ae7fa79f80a49b74f

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231023-es
resource tags

arch:x64arch:x86image:win7-20231023-eslocale:es-esos:windows7-x64systemwindows
submitted
26/11/2023, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.html.1
Size

246KB
MD5

9321a4e2cd4141a43965bc0dd98fc46e
SHA1

43efb3b3e1da7b4788d27c9549264b5d2a111cc2
SHA256

000444a623568f34fca2d4281a5bb95c13686514625941b4c53c0db63762a872
SHA512

7cb7a78d8575bda664042c1a5a6579f6caea344493cfc6be754270cee57b53932698db9ee9c268249f444bbe144243c83795b218973f6b90f33c96d6f11808b7
SSDEEP

6144:R0Rum7mdLRp1bbSBIR/EHGtCMXgTo8qoFt/etg+21pbys:R0E3dxtR/iU9mvUPGys

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3028	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3028	1808	cmd.exe	29
PID 1808 wrote to memory of 3028	1808	cmd.exe	29
PID 1808 wrote to memory of 3028	1808	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\index.html.1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\index.html.1
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads