214d4769d5859e7f3ea12c98f00aee573c03700bd46661da0af9bd6a5b41f93a

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KingRoot v1.3 2012.12.21.1805/root.sh
Size

20B
MD5

e9e8127c8fc08b5bb2de1cfda092033d
SHA1

88682ed625b3d45f905098a14ec3867e21ea8beb
SHA256

e0f4d86b3a2ee22d7ead0efe7bbe5ead669ba368bd5c9029e3ce01ffadcd2274
SHA512

59e2e6a006c68f0ea16ff4bd3f0e800f83090621a4a605e1ddbda19b93fff3d250a1ceda87079c51caecc6a0ecaba22136cf3b3606be42488f180c76117be55b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\sh_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\sh_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\sh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\.sh	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1980	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1980	AcroRd32.exe
1980	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2840	1992	cmd.exe	29
PID 1992 wrote to memory of 2840	1992	cmd.exe	29
PID 1992 wrote to memory of 2840	1992	cmd.exe	29
PID 2840 wrote to memory of 1980	2840	rundll32.exe	30
PID 2840 wrote to memory of 1980	2840	rundll32.exe	30
PID 2840 wrote to memory of 1980	2840	rundll32.exe	30
PID 2840 wrote to memory of 1980	2840	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\KingRoot v1.3 2012.12.21.1805\root.sh"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\KingRoot v1.3 2012.12.21.1805\root.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\KingRoot v1.3 2012.12.21.1805\root.sh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9748f23130d588e2183761c2e48356b1

SHA1
81965440aeb167cef480bc9ba0ec10e1ad7373dd

SHA256
73c24e0ee00c479f1c3190f7c8c6964fb67733bd26de18a36c5cb69a2985d538

SHA512
ddf4c91c917ff16b9c2842881b5a1ca904acadcc3bacb72e1b432ebcb5d3d3a79362156a501f4f772a617ef78efc26329f67dde54fba2219532ed8cb2cd49713

Download Submit