b2c2a9c32a27fe5c3872a0a96f96fad6597e4f8f5242ec90a7c2b69a1b409bb0

Resubmissions

11/02/2024, 22:08

240211-12e8qaca3t 10

11/02/2024, 22:01

240211-1xpxcsbh9s 10

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/02/2024, 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

empyrean-main/.gitignore
Size

40B
MD5

99548129ede134f3b093f2632c31e3c6
SHA1

bf7104b3ab481e8a8ce6c53dfa4d7fb50b9787f6
SHA256

40e5ba57447ba9d64413af1e81eeeb1a58a6fa09c66d7f5d680842e2eaedccc7
SHA512

f1dff38d6ea7a9dc4fe1273a2379c535a6d6b5d209d185be6234690be1368b222ca1e1434ff7c34f08685cd38cabe0ce0918e7c43bef6550f7e0ce60384d74f2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.gitignore	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.gitignore\ = "gitignore_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\gitignore_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\gitignore_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\gitignore_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\gitignore_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\gitignore_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\gitignore_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2908	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2908	AcroRd32.exe
2908	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 2992	1172	cmd.exe	29
PID 1172 wrote to memory of 2992	1172	cmd.exe	29
PID 1172 wrote to memory of 2992	1172	cmd.exe	29
PID 2992 wrote to memory of 2908	2992	rundll32.exe	30
PID 2992 wrote to memory of 2908	2992	rundll32.exe	30
PID 2992 wrote to memory of 2908	2992	rundll32.exe	30
PID 2992 wrote to memory of 2908	2992	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\empyrean-main\.gitignore
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\empyrean-main\.gitignore
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\empyrean-main\.gitignore"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6050b220a2896c421db1cbfa629d6389

SHA1
16cc894ef62f7ddc84f5d7668f004634ef57acc0

SHA256
908d81b39024824074390a882fe8640a1b59d1994d89d18f27a4b9e9c952bba5

SHA512
b3a953d195d4d39d8e60b312dc5b2cef79cec3676e8c78316aa8b1552c4abf40bfd9fb24c6052f77010c14b15dde2e8d23cd3270675560421dad4530116f8b21

Download Submit