07548b3bd8978a673ba74f5949d438685b8e569e092d057d04f305655714494b

Resubmissions

13/02/2024, 03:28

240213-d1bskshe72 7

13/02/2024, 03:26

240213-dzfp5shd54 7

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lucifer/branding/loginmsg.tfx
Size

46B
MD5

4b45bc2ddfd21892d91cd48b535dd32b
SHA1

447af8d3c3fcbc2c0f690556457196817c40b71f
SHA256

cade5ef7b4e5517180f5c67b5717c7f26a3d2a20ea5f4b7f6f9f58baee348bb9
SHA512

85db2516ae979a4da28a04ee467c49d191a28e9578d239e21d87ba7df9ceddc12ce9b7e7048c2b9bdd0300a184bd219729ecd06bdd283eb87aeb3ae5bba01deb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\tfx_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\tfx_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\tfx_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\tfx_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\.tfx\ = "tfx_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\tfx_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\.tfx	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\tfx_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2956	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2956	AcroRd32.exe
2956	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2324	2524	cmd.exe	29
PID 2524 wrote to memory of 2324	2524	cmd.exe	29
PID 2524 wrote to memory of 2324	2524	cmd.exe	29
PID 2324 wrote to memory of 2956	2324	rundll32.exe	30
PID 2324 wrote to memory of 2956	2324	rundll32.exe	30
PID 2324 wrote to memory of 2956	2324	rundll32.exe	30
PID 2324 wrote to memory of 2956	2324	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Lucifer\branding\loginmsg.tfx
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lucifer\branding\loginmsg.tfx
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lucifer\branding\loginmsg.tfx"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0e63f6e6858f003e0450bdae0cb254e4

SHA1
0993a64bf2839173e41bbfb0bd3cf91258010ab2

SHA256
1be290fa2245e42e37614e85e680da8b7d9f381d87191d42e2c23d9ba711a6c9

SHA512
84f36c25d98cbe64a05ec901fd9be36eb0df589d34174d2b02e9a7b03a0f17bec04da85c05e8800db108d6c36dcf0881c873cf1bf6ce0a555ceb65bfe0a0ecc7

Download Submit