499d1a574a23537ff5c8cd4b6e0675275065ea43629fbbf3c0d007bf7958e753

Analysis

max time kernel
1559s
max time network
1563s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSE.md
Size

1KB
MD5

172fb32b02b335508e62c04972eaad3f
SHA1

d6a7f831f796a0dbd099a558ff6965b3a67764f4
SHA256

499d1a574a23537ff5c8cd4b6e0675275065ea43629fbbf3c0d007bf7958e753
SHA512

0bd570c25ea0c38fcc62b4a4346b2e704b8e014e63ab1ed1a03314f36b08d770384496f7543da70cc43f464dead1bc9b10d167e5d84d2d1d3881663299a0c690

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\md_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\md_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2816	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2816	AcroRd32.exe
2816	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2164	3004	cmd.exe	29
PID 3004 wrote to memory of 2164	3004	cmd.exe	29
PID 3004 wrote to memory of 2164	3004	cmd.exe	29
PID 2164 wrote to memory of 2816	2164	rundll32.exe	30
PID 2164 wrote to memory of 2816	2164	rundll32.exe	30
PID 2164 wrote to memory of 2816	2164	rundll32.exe	30
PID 2164 wrote to memory of 2816	2164	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\LICENSE.md
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\LICENSE.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\LICENSE.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f20071d7d86b07de1a006aae3a587495

SHA1
8288bcfcb5066783608a83032d31f459f1825c18

SHA256
fa94171f1856292f8ad726300b4137213877fb8cbecd1bb0ee367739bc3889de

SHA512
c69e8104b7523a42d311c151f49cffe9e8094b04a4d53f4a723666b823c8e981808853d155ee1f15ba2d51be3264fee9e2c2a4328cf390df33c495ee32b3e07d

Download Submit