76a1ff6c0d7827ecd0857e5a9b5298337f232662767abf0f011154c85b6da8ef

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shaders/composite1.fsh
Size

2KB
MD5

3763ac36a26a254948ae896a44d26fae
SHA1

d1a2c0fee7332c36235e7c7b37024c29334e0aa5
SHA256

d563fc52213a9e5fc9f394b98541e67abe9edcc80ec914eaf94c201702e9a4ef
SHA512

51e3274176f1e04d80144e32d9dee884211922d96a78f01441dcda6ecbe0b062683586beb5d78270ca1985f3805813947cc61e146da9a3510dcc428828614459

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\fsh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\fsh_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\fsh_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\fsh_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\fsh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\fsh_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.fsh	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.fsh\ = "fsh_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2872	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2872	AcroRd32.exe
2872	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2712	1516	cmd.exe	29
PID 1516 wrote to memory of 2712	1516	cmd.exe	29
PID 1516 wrote to memory of 2712	1516	cmd.exe	29
PID 2712 wrote to memory of 2872	2712	rundll32.exe	30
PID 2712 wrote to memory of 2872	2712	rundll32.exe	30
PID 2712 wrote to memory of 2872	2712	rundll32.exe	30
PID 2712 wrote to memory of 2872	2712	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\shaders\composite1.fsh
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\shaders\composite1.fsh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\shaders\composite1.fsh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
08a78b7f4e8ddbfe5deb282fa7b5e049

SHA1
a9b13fc048954210361079699e023f06be05d33f

SHA256
1b84817d31fc10cb79f85c466c5ad2987ac2831879354bf91a5fa1bfcc7dced7

SHA512
7acbe1814e8355b6c36c13c36354579a169ac2d89d06fbcf82fcac2ed435f6f8ff9eaf62121b96990426212c7bf99e03f3c4408cc88fafb55960e8326f3356e2

Download Submit