86fd3e10f53379c41b740e719998bfdbeae563003b807009d44fb27f9b8aea6f

Analysis

max time kernel
115s
max time network
51s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BepInEx/config/BepInEx.cfg
Size

5KB
MD5

6fbb79abb157e750f22ca08a527f5e43
SHA1

55334443c0634bfaedbe4d3b33c825a26245a3ba
SHA256

8443d78f427027c263511cf66eec454ddf96dee397d042b4f8e00673d3653719
SHA512

0d99c0603e99b90295a0ce521bbc0c08763689df6928d3ec11c1a8801fed33ee3cbac90f70053cffd7d6adb7c9bbf195e7f7a7a7cd8f88747b8a51471caabe21
SSDEEP

48:5XUersx5gHtjYjnnV7xdT9xD+KFNel2ieevnrUn3V7apmvY7rUn3V7apuenY2z09:5XjESNjYjnxTLDtnUdxU36pU366GCnOU

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cfg_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.cfg	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cfg_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cfg_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cfg_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.cfg\ = "cfg_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cfg_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cfg_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3052	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3052	AcroRd32.exe
3052	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 2404	660	cmd.exe	31
PID 660 wrote to memory of 2404	660	cmd.exe	31
PID 660 wrote to memory of 2404	660	cmd.exe	31
PID 2404 wrote to memory of 3052	2404	rundll32.exe	32
PID 2404 wrote to memory of 3052	2404	rundll32.exe	32
PID 2404 wrote to memory of 3052	2404	rundll32.exe	32
PID 2404 wrote to memory of 3052	2404	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\BepInEx\config\BepInEx.cfg
1⤵
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\BepInEx\config\BepInEx.cfg
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BepInEx\config\BepInEx.cfg"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8ea721fd0cf5babf32b181273a96c0ed

SHA1
287647f58940ab7b15960076749aa3941d507839

SHA256
e15a95644ee97aaafdf1520b70de8a0a6a7d01d4243769615f5cffb57ea83b22

SHA512
03a280984f042ae9e78457e0b8e5a7ac8a140016fd75df70e72711cdc6b8809f1f09894b167fb3a0b6f5581359832af2550694dd5d5bd51ee63031bc3b356c66

Download Submit