f26f9a618a04f3af4ddbc73d7dc278b603f159e33ebd72442b4aa1bfcfe1824b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Teletubbies3.exe-Malware-main/Teletubbies3-safety/Teletubbies3/Release/Teletubb.c828e1ed.tlog/CL.read.1.tlog
Size

16KB
MD5

9c8986b54af0b4b8bb09425d663028e1
SHA1

0cd94cbaa942508e063ba20ac23560e784be7ad5
SHA256

a7dd855b7fff04268d3eddc3e81138d0006399a462e89a2095f3e0f1d4adb73d
SHA512

61f284af86f2d5c90d68611f80bc29a0a48878ea462782522598f882efb382821d96f071f954c43fbaac812bc0ca7a06c8ce9a52a33f18ecd55063cd1897fc1b
SSDEEP

96:WXAe7RrvlNcpy6b5ixJlJqJ/JewOsuPoWuQQyqs4/Dxg1SYEL9UMNtHBnR4MpOMA:Wwef0yqs4/FQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.tlog\ = "tlog_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\tlog_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\tlog_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\tlog_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\tlog_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\tlog_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\tlog_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.tlog	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2564	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2564	AcroRd32.exe
2564	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2584	3024	cmd.exe	29
PID 3024 wrote to memory of 2584	3024	cmd.exe	29
PID 3024 wrote to memory of 2584	3024	cmd.exe	29
PID 2584 wrote to memory of 2564	2584	rundll32.exe	30
PID 2584 wrote to memory of 2564	2584	rundll32.exe	30
PID 2584 wrote to memory of 2564	2584	rundll32.exe	30
PID 2584 wrote to memory of 2564	2584	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Teletubbies3.exe-Malware-main\Teletubbies3-safety\Teletubbies3\Release\Teletubb.c828e1ed.tlog\CL.read.1.tlog
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Teletubbies3.exe-Malware-main\Teletubbies3-safety\Teletubbies3\Release\Teletubb.c828e1ed.tlog\CL.read.1.tlog
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Teletubbies3.exe-Malware-main\Teletubbies3-safety\Teletubbies3\Release\Teletubb.c828e1ed.tlog\CL.read.1.tlog"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b778d3c9b91ed8139920856d3b9d31a7

SHA1
bc362276682b489f4e020d077b319d5549a94cdf

SHA256
b16cfc810b02a268bb3fd81f293acc6ad9c6b65b8ec83d46a138b9af0bb81f77

SHA512
589cf9954e4f8e97bc7342dfc3be640ccf8231dcaf1959331f15c012e37a4ed6368c188f77fafd5f65d896793ad468fbc44f72c1627698b79e68954b9e2bdb95

Download Submit