76a1ff6c0d7827ecd0857e5a9b5298337f232662767abf0f011154c85b6da8ef

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shaders/composite1.vsh
Size

161B
MD5

e8a764f8c9d8182c3f3f9bc46c1e1809
SHA1

c08e8213c6af8c07d06ca79e9b16aa8d89d270e3
SHA256

243ac68fccc02932b7102c12bb493e0ee2b8878c75d7ff7e253a2955b8f48973
SHA512

88f3178d1bb372a83517fce55cb715cebe2c007b92f79de9fc7457e3bcad42ba798b68c4c075b30d0c7521ea2c1e55b8364e18b906d97decd96f502309be6f2f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\vsh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\vsh_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.vsh\ = "vsh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\vsh_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\vsh_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\vsh_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.vsh	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\vsh_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2892	AcroRd32.exe
2892	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2824	2184	cmd.exe	29
PID 2184 wrote to memory of 2824	2184	cmd.exe	29
PID 2184 wrote to memory of 2824	2184	cmd.exe	29
PID 2824 wrote to memory of 2892	2824	rundll32.exe	30
PID 2824 wrote to memory of 2892	2824	rundll32.exe	30
PID 2824 wrote to memory of 2892	2824	rundll32.exe	30
PID 2824 wrote to memory of 2892	2824	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\shaders\composite1.vsh
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\shaders\composite1.vsh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\shaders\composite1.vsh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
35b941d60d339a023a24913ab3150aeb

SHA1
f59c1c800c9545b6acdbbb366bd6e963ab666a7f

SHA256
5c8a1166876a0fc71ff5022f857b975c73c209d9a6ec480a093246c779f517f9

SHA512
5ea890b2e532c0159e56652f3aab5c7a41d22b0681337d3630fe8b1afe6a9761619c883502a333e23f20edbc67c879f2f15249a05694b371b6ce90560dbef46a

Download Submit