6a20ed14350c485ccb8ede748b8b6e195a291b0fe48ac6359da3cb92e734ab1e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21-12-2023 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gosh/go.sh
Size

162B
MD5

09897179d2264af0459cd63fd5620884
SHA1

8a658478f6fa8b069bc3b8b458ceb8778b739131
SHA256

a57a62e6743b0ab59041fc363f110a6bca57f41637f7db35d4cf4f496adc90e9
SHA512

5c5358b66108e2a2791824c122c00e3f9a6a4eed954f4938a6776a564664bddfbd8f8be0563e3f7de606e635bb4ba94bdd72aff11dfbd952bb6b8478bf9cf7b3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.sh	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\sh_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\sh_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\sh_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3052	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3052	AcroRd32.exe
3052	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2484	2044	cmd.exe	26
PID 2044 wrote to memory of 2484	2044	cmd.exe	26
PID 2044 wrote to memory of 2484	2044	cmd.exe	26
PID 2484 wrote to memory of 3052	2484	rundll32.exe	30
PID 2484 wrote to memory of 3052	2484	rundll32.exe	30
PID 2484 wrote to memory of 3052	2484	rundll32.exe	30
PID 2484 wrote to memory of 3052	2484	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\gosh\go.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\gosh\go.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\gosh\go.sh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
815b10ce1ba0d5c83557e408166509d6

SHA1
38e4bd39e3eeb22018d4897aed6954888c339517

SHA256
9c46e773136968c56e66bae5ef9b76e28b9a1a47d0be18da774cc7090ceaaca6

SHA512
2f24523169c679777d3841bdaa4fa8e5f103e7d38e3b91b36122364cb43e7980211086d2e3e5d59270d614c0c10c2adf90e8608ef4cd82521edb8170e0a98e76

Download Submit