8cab28260b0d5ba85f62466987884c6a26e3462f98911d3357a01164fe2165be

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ssh/go.sh
Size

85B
MD5

5438ec7204e0c480aa216502c91daf40
SHA1

f3e1b599cd9a9eaa3ff8843e6897ef0bc0d21de5
SHA256

9499ac0b294630d29991e81c3ca9a856d169f1ae1298aef729b78a4c587850fd
SHA512

5ffc9866798cd1806f7b3d2a8954c3af8006a1fd303bde770ff2514881eb26a456fc8b4dada731c7ae4a102196560d79796e27d6041b87fec09ef881d63c5859

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.sh	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\sh_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\sh_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\sh_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1600	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1600	AcroRd32.exe
1600	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 680	1984	cmd.exe	29
PID 1984 wrote to memory of 680	1984	cmd.exe	29
PID 1984 wrote to memory of 680	1984	cmd.exe	29
PID 680 wrote to memory of 1600	680	rundll32.exe	30
PID 680 wrote to memory of 1600	680	rundll32.exe	30
PID 680 wrote to memory of 1600	680	rundll32.exe	30
PID 680 wrote to memory of 1600	680	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ssh\go.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ssh\go.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ssh\go.sh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
efbc71f6656aa12c59e57b9b63efd160

SHA1
893235b850fa3d13192e95538c9eafe2f69b58de

SHA256
b3513fe04db56240644f9cef96ce24aba3305f0a61be1e35601675ee3ffac0b3

SHA512
cbd2173ca37532af6fb82612f15329598c346767e45db9a036e67e8a42533f34c16448e2b5de04edf55979997671926856b845f65568ffb88bc90fcad295f965

Download Submit