b9a7c3c6e4a93465b5800d940825f318c4f1880f956f7ef80e1cb4fe0a380a6b

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Luna-Grabber-main/.github/ISSUE_TEMPLATE/bug_report.md
Size 541B
Sample240201-sjpqfaacbq
SHA256 e214fac2913661096600939e4cb3cfdd747d0ebbc13784e468e5afaf2601b322
MD5 19dcdd1cd8633266aa38efdac488f7c3
SHA1 db457b0ca0fad4ed5fa6bc749f72feb865418df9
SHA512 75d940fbe54c7faa73bb6ce394b166d653c6873635bcb28fd3307f601ac69ba93b0f7001c52bb299771a305a77606f090b70bae91b7271dcd8170b1d8ede2588
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\md_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.md	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2728	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2728	AcroRd32.exe
2728	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2404	1684	cmd.exe	29
PID 1684 wrote to memory of 2404	1684	cmd.exe	29
PID 1684 wrote to memory of 2404	1684	cmd.exe	29
PID 2404 wrote to memory of 2728	2404	rundll32.exe	30
PID 2404 wrote to memory of 2728	2404	rundll32.exe	30
PID 2404 wrote to memory of 2728	2404	rundll32.exe	30
PID 2404 wrote to memory of 2728	2404	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\.github\ISSUE_TEMPLATE\bug_report.md
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\.github\ISSUE_TEMPLATE\bug_report.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\.github\ISSUE_TEMPLATE\bug_report.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 655e3012c377a618353b6b310aaee377bf13d2fc009e72cfd9cf3faf6c107ffc
MD5 02d384a1e6bf0178ddb9cb02ed36a1c1
SHA1 6c427928658f10f6b0a72429da28b64001c9c863
SHA512 30250e79be237c2c86eb61f303aa84400f4d88e9743fdb9d8cc59b97424be7597394689ee9ceb533dc9f6394d4e1ad3b5f6e9b3ee9fce2e3f65b2168180d2bf4
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis