bb9fd404eab8d0b9071e2e7df592994dfc78401fe1073f36128bed4522d3039a

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gosh/go.sh
Size

81B
MD5

518fce261a1a6471485c7f9e8645294b
SHA1

9e397e6bc743ae6b1057f327c7010c9a09dbd4e9
SHA256

19094769773572fb87e65adbebe37c786b7fad7d275a6f79b96d818ebd9dbc6f
SHA512

93567efb08978161a1decff56c1ade43ff1fe5cb3e33975651e54eff7f7e98fbe5989a22ef766ee6315c1efc785e756c63202f259dcda05250950595f31f88c7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\sh_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\sh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.sh	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\sh_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2808	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2808	AcroRd32.exe
2808	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2720	3044	cmd.exe	19
PID 3044 wrote to memory of 2720	3044	cmd.exe	19
PID 3044 wrote to memory of 2720	3044	cmd.exe	19
PID 2720 wrote to memory of 2808	2720	rundll32.exe	30
PID 2720 wrote to memory of 2808	2720	rundll32.exe	30
PID 2720 wrote to memory of 2808	2720	rundll32.exe	30
PID 2720 wrote to memory of 2808	2720	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\gosh\go.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\gosh\go.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\gosh\go.sh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
219196fe3ebcd3064fbfedc3f3d97d26

SHA1
f25fb694e7ff1fcccb70178cc0492ffbdb1df717

SHA256
b0faebb25ed280f426cc4c22f5e761e819e202f6d488178a58ffbc151e5aba78

SHA512
bdf89456a0999418e63dbf798ae5a36633edf0f2ed68246baccdd1e9b16adf5e9fdc73a40b5d64bde59c12cb07aaf95ca97864fd953c123365b48b6120603b08

Download Submit