cf0727f41b07fd578b6117569837a43c0e9163b3c80ecdec909813187457257c

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ssh/go.sh
Size

85B
MD5

5438ec7204e0c480aa216502c91daf40
SHA1

f3e1b599cd9a9eaa3ff8843e6897ef0bc0d21de5
SHA256

9499ac0b294630d29991e81c3ca9a856d169f1ae1298aef729b78a4c587850fd
SHA512

5ffc9866798cd1806f7b3d2a8954c3af8006a1fd303bde770ff2514881eb26a456fc8b4dada731c7ae4a102196560d79796e27d6041b87fec09ef881d63c5859

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\sh_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\sh_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\sh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.sh	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2600	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2600	AcroRd32.exe
2600	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2556	2640	cmd.exe	28
PID 2640 wrote to memory of 2556	2640	cmd.exe	28
PID 2640 wrote to memory of 2556	2640	cmd.exe	28
PID 2556 wrote to memory of 2600	2556	rundll32.exe	29
PID 2556 wrote to memory of 2600	2556	rundll32.exe	29
PID 2556 wrote to memory of 2600	2556	rundll32.exe	29
PID 2556 wrote to memory of 2600	2556	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ssh\go.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ssh\go.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ssh\go.sh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
24cd95470e491c460e35977522dc1dc9

SHA1
50587c988d4700f5483fd843508d23bb5497a766

SHA256
f4b0c51673c5ae14915b0a9609834525b3803732f70db850c6aa0915ef728137

SHA512
7c80e86ea049f5a4dc7779306d0ac65bf1a9ae892b4b6188ad1a42f9614738448aa9c55e60d1f57ba0b0fb6f12b65a88fee17e3ced9fbe139fc2daddbab5fa1c

Download Submit