b17d10408e97c9211d0f1f34f9592c2823c5982760209d30cff2ae263b96efc3

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eclipse-grabber-main/inst/BUILD.md
Size

1KB
MD5

011a6ee2ea81de0e4e90089c5cd7443b
SHA1

007c78470ff379bb2a715014061b5ae54c973923
SHA256

a2976bc3b2e9470cfc30031666fedc540ffab624ae19bd5a6aa1eeb85b74084b
SHA512

206e005e94316be1c59c178a15eb0b48ffaf1b6c7a9494e485a2a3bc2409ba1a2d4cb3e35b4a94a647b1bc64d56c0b6a008f1777087147cb45c332a254678f84

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2620	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2620	AcroRd32.exe
2620	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 3008	2780	cmd.exe	28
PID 2780 wrote to memory of 3008	2780	cmd.exe	28
PID 2780 wrote to memory of 3008	2780	cmd.exe	28
PID 3008 wrote to memory of 2620	3008	rundll32.exe	31
PID 3008 wrote to memory of 2620	3008	rundll32.exe	31
PID 3008 wrote to memory of 2620	3008	rundll32.exe	31
PID 3008 wrote to memory of 2620	3008	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\eclipse-grabber-main\inst\BUILD.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\eclipse-grabber-main\inst\BUILD.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eclipse-grabber-main\inst\BUILD.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6ba0ee2ee150cf9a437c7ac4a2cadd02

SHA1
dc6db9f9d98a1c5660b53d04d71ea2e01d723b99

SHA256
f6c20020b0d40cea8afc0781d15a11ee697609905d2c1529ba6e5dacc542363e

SHA512
e62de5e5b1f6ad90c004f1f8fd5c74a364f4634422beed1af5ae312b373215e4c8b20358b2dcfebae1c50760d76e28a386d2b192fb4cc28358e900cfe50db961

Download Submit