a72d511440bc3d2df8c91e072b8033709cd08e42be66ef8205776f1e200fbad5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a72d511440bc3d2df8c91e072b8033709cd08e42be66ef8205776f1e200fbad5.sh
Size

1KB
MD5

c0d4438a5d13113144d7f5e2934f04a5
SHA1

0ae10851463cfd270d538f00e3f06b0c1d364e34
SHA256

a72d511440bc3d2df8c91e072b8033709cd08e42be66ef8205776f1e200fbad5
SHA512

6401c0473be2e9d3d1271d53d649176737f3811ad53762134ccd06dbb4ac60254e12fd9aedf0960277047ea5fd64324e2256aef06d44852dd1c4b0fac1c24db6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\sh_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\sh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.sh	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\sh_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2544	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2544	AcroRd32.exe
2544	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2548	2924	cmd.exe	29
PID 2924 wrote to memory of 2548	2924	cmd.exe	29
PID 2924 wrote to memory of 2548	2924	cmd.exe	29
PID 2548 wrote to memory of 2544	2548	rundll32.exe	30
PID 2548 wrote to memory of 2544	2548	rundll32.exe	30
PID 2548 wrote to memory of 2544	2548	rundll32.exe	30
PID 2548 wrote to memory of 2544	2548	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\a72d511440bc3d2df8c91e072b8033709cd08e42be66ef8205776f1e200fbad5.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\a72d511440bc3d2df8c91e072b8033709cd08e42be66ef8205776f1e200fbad5.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a72d511440bc3d2df8c91e072b8033709cd08e42be66ef8205776f1e200fbad5.sh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8f2e74783867806c61f502f92180a323

SHA1
9f7b33f065f5dab3262c55bb857b027a6de89cfe

SHA256
19920fcc44a58eb3456565cc02463f957de0a54ef20f640e9ef7bf1f46246e85

SHA512
dfac80f8a2207bc6a094e6f1cac966f7199b30bb87a0b5769ef704016f9310d89d685e8f783e5cdaf85d83c314d873ffdf39960cfcaf9003393ab37f8eca7adb

Download Submit