f54b8e56441f319b166da0a8f799283ee22a5592642d7ccf28c0b5a5f70c637e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gosh/go.sh
Size

94B
MD5

e8feac3a02de79f8564df80b02d83a51
SHA1

a831e7dace3c73ca3b539eb546d86c207f348664
SHA256

24ed8459a6aee307b47b64355c11eda8273b58403a47e800107126b520b3a69e
SHA512

16d7ea08bd009322a58a4f1eb8d3dd426b09f6587c579bb06383323b786316c955b31eb1de46fc4c6d33712b7468fd419f6523741d747041eda2526d6c9bd199

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\sh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.sh	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\sh_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\sh_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2680	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2680	AcroRd32.exe
2680	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2320	2220	cmd.exe	17
PID 2220 wrote to memory of 2320	2220	cmd.exe	17
PID 2220 wrote to memory of 2320	2220	cmd.exe	17
PID 2320 wrote to memory of 2680	2320	rundll32.exe	30
PID 2320 wrote to memory of 2680	2320	rundll32.exe	30
PID 2320 wrote to memory of 2680	2320	rundll32.exe	30
PID 2320 wrote to memory of 2680	2320	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\gosh\go.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\gosh\go.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\gosh\go.sh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
18219ea31e05f6785809a58529a975a2

SHA1
be6a7f38a501599bab0c62df91b1fb480093ad36

SHA256
0cac861864c7bc57bcf2385f99f9c836cd83b2db3b889671860ffbc897a43ffd

SHA512
2d6c01e2e4b548b88dd15792d1b7ef69aedbcecd55096be3b103fb4f5bdc76ce364b2b0b00182c76b195eef3b451cb9fa9a1d489e0bab567e008fe2613553b15

Download Submit