07548b3bd8978a673ba74f5949d438685b8e569e092d057d04f305655714494b

Resubmissions

13/02/2024, 03:28

240213-d1bskshe72 7

13/02/2024, 03:26

240213-dzfp5shd54 7

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lucifer/branding/methods.tfx
Size

16KB
MD5

987b773de8805043ed3abf10638e7b48
SHA1

aa45003b347c055a2f00d64a8f4af5bbb15f8964
SHA256

09bf83902f7d7070878104a8ae94782b4abe5dc915d7908c091ebb371b017a02
SHA512

3ca33116641aaf90ddc245d347d89543a0accca6cecaf94b960b6f1a26ee7d6eb21a28b400b268b59910a0387b26366d96be5e0c8abd4598dba265a81790b2f8
SSDEEP

384:Ra8eWQnOg6IrlLZmLCJQAUXstssGKMlcpaqxa8eWQnOg6IrlLZmLCJQAUXstsh4C:Ra8eWQnOg6IrlLZmLCJQAUXstssGflch

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.tfx	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.tfx\ = "tfx_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\tfx_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\tfx_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\tfx_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\tfx_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\tfx_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\tfx_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2828	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2828	AcroRd32.exe
2828	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2680	2856	cmd.exe	18
PID 2856 wrote to memory of 2680	2856	cmd.exe	18
PID 2856 wrote to memory of 2680	2856	cmd.exe	18
PID 2680 wrote to memory of 2828	2680	rundll32.exe	30
PID 2680 wrote to memory of 2828	2680	rundll32.exe	30
PID 2680 wrote to memory of 2828	2680	rundll32.exe	30
PID 2680 wrote to memory of 2828	2680	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Lucifer\branding\methods.tfx
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lucifer\branding\methods.tfx
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lucifer\branding\methods.tfx"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
84d3fe8efa8645fa390fe662fbde45c8

SHA1
0c59101fb41b9ed2160e4c128c1415c8b690e504

SHA256
9bb3b3e1dd10c505dc66df7041c733c720f754258765a42af6e060892af9ae12

SHA512
87d7685bd0423e44e1b18a2d0ce6a625700326005df93d325ae084ce656cd73d307acb5eda9588c57a4736389834ee18771b065204466f23662fd945c60663ca

Download Submit