76a1ff6c0d7827ecd0857e5a9b5298337f232662767abf0f011154c85b6da8ef

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shaders/composite3.vsh
Size

13KB
MD5

7e464810e325e897cfdde12a2081a2da
SHA1

bd54889e3b45430698c3ee179b9d45499e26724a
SHA256

02d8e15e75260bc4665f5fd26c97be55f62e555d4bccd33befd0dd72ec5da625
SHA512

8f52fce73da5a8f8798fc5ac3a1d4bfb0ba77cac30674734ce9d64bc0706e9a7490fa7ad861dfc8c51af04d908578793ee0c93c987db889fdf8262d235f5801c
SSDEEP

192:V/8HtYqxGsXU63NwfCguxwyQf13PMdPBn5wyjYj3nPB5DLE0QyyPH:eyRoUBfCgr130NB5wQuXZsH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\.vsh\ = "vsh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\vsh_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\vsh_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\vsh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\.vsh	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\vsh_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\vsh_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\vsh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2744	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2744	AcroRd32.exe
2744	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2864	2240	cmd.exe	29
PID 2240 wrote to memory of 2864	2240	cmd.exe	29
PID 2240 wrote to memory of 2864	2240	cmd.exe	29
PID 2864 wrote to memory of 2744	2864	rundll32.exe	30
PID 2864 wrote to memory of 2744	2864	rundll32.exe	30
PID 2864 wrote to memory of 2744	2864	rundll32.exe	30
PID 2864 wrote to memory of 2744	2864	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\shaders\composite3.vsh
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\shaders\composite3.vsh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\shaders\composite3.vsh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f70d25e8327a11e2ace8de668e74a7c9

SHA1
23d637f70046a14e772b9c49fbbbf5cac0c55a32

SHA256
63a0fd0039c2edbb4d7b81d1754d24ea0e64e439302d41737bbe8b75f86c14cb

SHA512
1b19ff77d3f481eae6335a4182f90c4a742c7278a3ec0d9d5ff79863b59397266df07a8650e1bc7d5334a24740edc9c0e13846acb769ce6474a8a0a7a898a67c

Download Submit