07548b3bd8978a673ba74f5949d438685b8e569e092d057d04f305655714494b

Resubmissions

13/02/2024, 03:28

240213-d1bskshe72 7

13/02/2024, 03:26

240213-dzfp5shd54 7

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lucifer/branding/help.tfx
Size

13KB
MD5

7fd7d2e3eadfa9532683ec2e7475c27b
SHA1

4cca4b4a5ad9abb9afa076e0704f229a25ee8d2b
SHA256

2146a5a5f7b1899f2215344cd4415a1c98a8bf376b17c9bde08bc05f541bfa23
SHA512

b20064efbbddddbdac20e10bef243ce51c36d894f9a802beedc0b07868d49ff8987c0289d8250cfc6f7f94445b677035270b632ab0051bf90c68c038b751ff3b
SSDEEP

384:hlcM5ca8eTx+wKIrlIwkhkQAESAqxLGkOhkqdlcM5ca8eTx+wKIrlIwkhkQAESAI:hlcM5ca8eTx+wKIrlIwkhkQAESAqxLG7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\tfx_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\tfx_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.tfx	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\tfx_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\tfx_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\tfx_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.tfx\ = "tfx_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\tfx_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2376	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2376	AcroRd32.exe
2376	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2592	2876	cmd.exe	29
PID 2876 wrote to memory of 2592	2876	cmd.exe	29
PID 2876 wrote to memory of 2592	2876	cmd.exe	29
PID 2592 wrote to memory of 2376	2592	rundll32.exe	30
PID 2592 wrote to memory of 2376	2592	rundll32.exe	30
PID 2592 wrote to memory of 2376	2592	rundll32.exe	30
PID 2592 wrote to memory of 2376	2592	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Lucifer\branding\help.tfx
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lucifer\branding\help.tfx
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lucifer\branding\help.tfx"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b1fa8b4469cf1f94dfe213c7632c69d1

SHA1
6df0e8b69bc9b3ae8ab21cb2d1865d9c29569d9a

SHA256
60f0a6760a6af22aa4b6317e604551772418feb685dee9aae26a0b91f7a5c822

SHA512
34e20761038a166d72ad615cc9566626f9c7ed5e0859701e560b0f26e7f92cd7f5cd093e811b3180d363ec6bbb670dcf4fcda9167591a98ba12ddd00fb07f048

Download Submit