852c6a6dc44f89ab993c6e9bf1177b021e63597f82c3ff5136d4e8fe358d5d42

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Scripts.gz
Size

286B
MD5

17d697242242d12d5d00f5004406acd8
SHA1

82b470b466da67fdea7ef71a0aeaad0a4be6fdf1
SHA256

19902caa2fa9071f232c7cec6082de8dea461e5199fdf2b87f8be0320dd17ac2
SHA512

a3058a77f47bde22393dc20ab1be018ba477e428e17d089c25a9650cfec590feaf772ba8064b05c4c13bd10461d27fe6864b050ec62f74c847ec8bda55bac6f4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.gz	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\gz_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\gz_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\gz_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.gz\ = "gz_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\gz_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\gz_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\gz_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2624	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2624	AcroRd32.exe
2624	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2092	2032	cmd.exe	29
PID 2032 wrote to memory of 2092	2032	cmd.exe	29
PID 2032 wrote to memory of 2092	2032	cmd.exe	29
PID 2092 wrote to memory of 2624	2092	rundll32.exe	30
PID 2092 wrote to memory of 2624	2092	rundll32.exe	30
PID 2092 wrote to memory of 2624	2092	rundll32.exe	30
PID 2092 wrote to memory of 2624	2092	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Scripts.gz
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Scripts.gz
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Scripts.gz"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
db82ce48cf511f0948865b5d26658b39

SHA1
c1625d6cdeda907a3b57083c8cd9d670e5ae30f4

SHA256
5e60f5b51d61de534bfdb9f8269690ddf104667ab27a822b9f2183dc17669531

SHA512
aa5f9499ffa7899c5fee604f7ade6b1e5ae12b6fec44e4e942079d301dfadfa18d4c3f28a7d89bcf047854b93455617676bddea1b1b5380d9a93579468b50482

Download Submit