27a94b5c46b4f4b31e422b1b93d44c2276fb3701f9cb0f03f80b85ac052d17cc

Analysis

max time kernel
153s
max time network
136s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
26-11-2023 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

!VAST/config.toml
Size

2KB
MD5

0d52eedcf9fa6c6aefb463c7580dd55b
SHA1

f8b88ced908ab719ae13d5f44ed35a50f8e72e39
SHA256

b897245ed175010fff857aebc048d73217a1a62022fc5cf3498735b04c4b3b19
SHA512

c3df6ac1a292b1d66a8b87aef237214c307b4aeadb60548f57a7fa4e254bd4078a0a60e3985484ba2a7f879345be85af3b9bcc9717a4d883db5485ca0e72b0c7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\toml_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\.toml	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\.toml\ = "toml_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\toml_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\toml_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\toml_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\toml_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\toml_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2728 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2728 AcroRd32.exe
2728 AcroRd32.exe
2728 AcroRd32.exe

pid	process
2728	AcroRd32.exe

pid	process
2728	AcroRd32.exe
2728	AcroRd32.exe
2728	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2988 wrote to memory of 3048	2988	cmd.exe	rundll32.exe
PID 2988 wrote to memory of 3048	2988	cmd.exe	rundll32.exe
PID 2988 wrote to memory of 3048	2988	cmd.exe	rundll32.exe
PID 3048 wrote to memory of 2728	3048	rundll32.exe	AcroRd32.exe
PID 3048 wrote to memory of 2728	3048	rundll32.exe	AcroRd32.exe
PID 3048 wrote to memory of 2728	3048	rundll32.exe	AcroRd32.exe
PID 3048 wrote to memory of 2728	3048	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\!VAST\config.toml
1⤵
- Suspicious use of WriteProcessMemory
PID:2988

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\!VAST\config.toml
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3048

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\!VAST\config.toml"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
078b4cb1b8c46087283261e97d453dc3

SHA1
6d638b82d29ef0fbb2b93b91f82446d5f1a033b2

SHA256
9be2557b882f2c66ccc689c88b0d1c4a217273bc7dd8f24dd0df3291a4ae2360

SHA512
6f5ed45a0ef3598b99a9a0c3e6e12bebc9f06e044de21eeccd944512ebf08ecce6b297b6f18f75c3729a2d068230692b6d03e6bdd2cacbd72b2e4c51c61f1677

Download Submit