f26f9a618a04f3af4ddbc73d7dc278b603f159e33ebd72442b4aa1bfcfe1824b

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Teletubbies3.exe-Malware-main/Teletubbies3-safety/Teletubbies3/Release/Teletubb.c828e1ed.tlog/CL.write.1.tlog
Size

518B
MD5

0c6fb2be3c63b46929078a97b613b840
SHA1

7f808ec7ac52a3f3d010b47b3cd5b655831f5529
SHA256

db9d47a89a6c2ae96b63d19f0b6ba928a4f3e6fcf719749d3fbbf7009381a261
SHA512

12490b2f2667fc546cbddb92b6369f0d3b8e27509c52300fea024782b9817e65ac085b15b152e54def4f19afbc87e0f7ddb9525a32d6365c0e5755e0bf43e774

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\tlog_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\tlog_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.tlog	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.tlog\ = "tlog_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\tlog_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\tlog_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\tlog_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\tlog_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2660	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2660	AcroRd32.exe
2660	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2544	3044	cmd.exe	29
PID 3044 wrote to memory of 2544	3044	cmd.exe	29
PID 3044 wrote to memory of 2544	3044	cmd.exe	29
PID 2544 wrote to memory of 2660	2544	rundll32.exe	30
PID 2544 wrote to memory of 2660	2544	rundll32.exe	30
PID 2544 wrote to memory of 2660	2544	rundll32.exe	30
PID 2544 wrote to memory of 2660	2544	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Teletubbies3.exe-Malware-main\Teletubbies3-safety\Teletubbies3\Release\Teletubb.c828e1ed.tlog\CL.write.1.tlog
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Teletubbies3.exe-Malware-main\Teletubbies3-safety\Teletubbies3\Release\Teletubb.c828e1ed.tlog\CL.write.1.tlog
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Teletubbies3.exe-Malware-main\Teletubbies3-safety\Teletubbies3\Release\Teletubb.c828e1ed.tlog\CL.write.1.tlog"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
821768c189b1fb35145c126a83314d83

SHA1
e43b119be2e7d6e41df79c9e324df2030f965e55

SHA256
de3ec4f30feac2aeb5604bdf947e2bfa45f7a3b4b12848a3796354209f5faab6

SHA512
4c85de120c49edb1f7daddcfedd60ed96e12ec9b57d159a0af9a641f99eee98c8f543388e7a42a91dcb1eef56a565a542193727cfab69657fad54e2514938467

Download Submit