652dcfa352f97af40933db5d5c5c56b97875d0b0ffc877703d92413cb1f8aa63

Analysis

max time kernel
103s
max time network
18s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kiwi X External/bin/configs/Default.cfg
Size

242B
MD5

b47d1a2bc36a795202af83be26a79c1a
SHA1

6645a705ef1715957824b1c7d7b73adb69cc86f8
SHA256

61f2fc3538767feec088d8272f624e52f2e4f98add7f191eeb80bf5cd30854a1
SHA512

c114df1a8829cb4b204ff615dd970ca9e723e73648c40b2d2e1879ebabaccecae0d8b02df39f6acc2b5729ccfa8c10a765ae5ab7e08adbb2b3c4aad0de66f6b1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cfg_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cfg_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cfg_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cfg_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cfg_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\.cfg	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\.cfg\ = "cfg_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\cfg_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2972	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2972	AcroRd32.exe
2972	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2760	1196	cmd.exe	29
PID 1196 wrote to memory of 2760	1196	cmd.exe	29
PID 1196 wrote to memory of 2760	1196	cmd.exe	29
PID 2760 wrote to memory of 2972	2760	rundll32.exe	30
PID 2760 wrote to memory of 2972	2760	rundll32.exe	30
PID 2760 wrote to memory of 2972	2760	rundll32.exe	30
PID 2760 wrote to memory of 2972	2760	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Kiwi X External\bin\configs\Default.cfg"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Kiwi X External\bin\configs\Default.cfg
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Kiwi X External\bin\configs\Default.cfg"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9f53b8ebc7c2a21f676500e195501713

SHA1
5710ca481650041c9416679f2acf142424ee3aff

SHA256
b7680273bb203f8684c61b7121fc3b1b3efafbe631df01a0eed2b0dd55685ee3

SHA512
5fe05da42a665d95cf4a502492a7050d542d987a939dbb988698f2aa93fe53ce86c34169cce8c0ca8a1da8da28bfa10940e7ae951bab5dbd95b5e16b719874dc

Download Submit