8e3cc815594eb8381d045efdc37f00787c15e8a39a9cf9eae092b4f1b02bd6df

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MHDDoS-main/README.md
Size

10KB
MD5

87cd6d37e42f80173c71c78f743ee0d6
SHA1

e6ae849b48c12ab2f7419d5cdd938c76ec37af0e
SHA256

e8e5b09c4611cac5997be57ab9b2181ed1b7f369dfb489a0719673c6a50548e6
SHA512

11606b62e072b3a9cc2cfc89f4057ca970987768e95adfcabda0c0dfe837f0f9b001913a428399ef38df2c588df341086c3dcfdded959bc2ac5b2fe0d7f50bbc
SSDEEP

192:U0apf8LPzj0W8hG+ge8Sv+j6gr1y9+0cHe0xZUUItmNSDN3OOFuBXMucNW6f5KEm:U0YfUPzWG1eIiPcHVMUWmNSDN3OOFOWW

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.md	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2752	AcroRd32.exe
2752	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2748	1056	cmd.exe	29
PID 1056 wrote to memory of 2748	1056	cmd.exe	29
PID 1056 wrote to memory of 2748	1056	cmd.exe	29
PID 2748 wrote to memory of 2752	2748	rundll32.exe	30
PID 2748 wrote to memory of 2752	2748	rundll32.exe	30
PID 2748 wrote to memory of 2752	2748	rundll32.exe	30
PID 2748 wrote to memory of 2752	2748	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MHDDoS-main\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MHDDoS-main\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MHDDoS-main\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e9938d4eba5b418dd7db2b368711dc4a

SHA1
b30e684e5af3931b149402d762840bdda0075db3

SHA256
8460a1ef68697c336d6af5e839eff5eab80325206ce0435f695ecd745fae29e3

SHA512
35f100b9a1786d08330a9781caac46c4f41bfc93b4cad845fa5e1fc38be2b0751d79348b106bc8acfeddfff688ee1929bcbce2cc4bc6d1917479abacfa8e8e92

Download Submit