07548b3bd8978a673ba74f5949d438685b8e569e092d057d04f305655714494b

Resubmissions

13/02/2024, 03:28

240213-d1bskshe72 7

13/02/2024, 03:26

240213-dzfp5shd54 7

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lucifer/branding/rules.tfx
Size

485B
MD5

9e06f994b74665b8b033895352b66b7d
SHA1

2ed3c3fd7bf238e061962528935e23c869384db0
SHA256

ff93014af57901a37645a9aac6c79dbc260e28aa5ffa95cd1759c796897cb41c
SHA512

0d40ae221fe92ec704b4877ff623c38b74a601808d4b869732d5e86d1d2db8c7a5d3ddf8aa05c03d1c1a59fb8d6e8210fac9492b0a9a101dc027271e5df0b0f9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\tfx_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\tfx_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.tfx	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\tfx_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.tfx\ = "tfx_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\tfx_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\tfx_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\tfx_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2912	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2912	AcroRd32.exe
2912	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2696	1300	cmd.exe	29
PID 1300 wrote to memory of 2696	1300	cmd.exe	29
PID 1300 wrote to memory of 2696	1300	cmd.exe	29
PID 2696 wrote to memory of 2912	2696	rundll32.exe	30
PID 2696 wrote to memory of 2912	2696	rundll32.exe	30
PID 2696 wrote to memory of 2912	2696	rundll32.exe	30
PID 2696 wrote to memory of 2912	2696	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Lucifer\branding\rules.tfx
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lucifer\branding\rules.tfx
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lucifer\branding\rules.tfx"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e1b60cb785909a94bb213355cbe7de24

SHA1
dd5f0b956995af45a2917f001af0fb479d3eab7e

SHA256
4ad1ef3a974b59e9db89794d69cd9be8b184be0d2a119fc0613113246c0ec394

SHA512
6186d254afd81f62b2380f4213ff6e04a282e2a64430bf936486da39b378f40acacccd8e27ed190ebb96e75262560fa482fcedb446aaddd1054395f13916ee0b

Download Submit