76a1ff6c0d7827ecd0857e5a9b5298337f232662767abf0f011154c85b6da8ef

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shaders/composite2.vsh
Size

14KB
MD5

4322633ca776b34e1eda5d6ae66d34bc
SHA1

b537070ac2d4507194e88c7d0b51408486367e8c
SHA256

5b399982b2c72f2115376930d47a1a904acae99017bcbd88da786f5f5528ade1
SHA512

51c03ba428b047c40fd8744b9d748d6c85366f271a29771a76f229d23de067ea17405b35970b4337bb142849e83322cf466cbf2c1f5f61351a0d5258b00fde19
SSDEEP

192:Qk8HcYWxGsXU63NwfCganwyQf13PMdPBn5wyjYj3nPB5DLE0QyyPW6RGUmBUJ:STFoUBfCg/130NB5wQuXZsW6RGUmBUJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\vsh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.vsh	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.vsh\ = "vsh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\vsh_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\vsh_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\vsh_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\vsh_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\vsh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2592	AcroRd32.exe
2592	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2688	2488	cmd.exe	29
PID 2488 wrote to memory of 2688	2488	cmd.exe	29
PID 2488 wrote to memory of 2688	2488	cmd.exe	29
PID 2688 wrote to memory of 2592	2688	rundll32.exe	30
PID 2688 wrote to memory of 2592	2688	rundll32.exe	30
PID 2688 wrote to memory of 2592	2688	rundll32.exe	30
PID 2688 wrote to memory of 2592	2688	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\shaders\composite2.vsh
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\shaders\composite2.vsh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\shaders\composite2.vsh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
42cef6629cc4356f41f106534bf87ba3

SHA1
0619ca1a417f2884a1ef999175dc331a0539343f

SHA256
473349ff512845b22baa91e2c1d59e50fe9348338519a7f6059f0783610e6d03

SHA512
fc0416f6b8c55236d6470b2da312dd09bab9731a9d559289f22db32714ca2fa407b905859f8c1c3c1106c219098341951fc7a26e3be1fcb947c0b970cc884bdb

Download Submit