f26f9a618a04f3af4ddbc73d7dc278b603f159e33ebd72442b4aa1bfcfe1824b

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Teletubbies3.exe-Malware-main/Teletubbies3-safety/Teletubbies3/Release/Teletubb.c828e1ed.tlog/link.read.1.tlog
Size

3KB
MD5

32ccc4e81287f9966bfd60292db504ed
SHA1

a7a12f34f5a5cfa9af7276ba49b66727a506d623
SHA256

8e878e65debb67a5872dca3fb5a7f5b89c6c2683b4bf6e8d262e972362723ee5
SHA512

e491fd875c7d22a434baf3d414823b4b3ed18556147b8fb89b4432acb39620843b13b47fa8537534eb1bcb7ee899f03224a5d7bffc8c3974462af404e7213a3b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\tlog_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.tlog\ = "tlog_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\tlog_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\tlog_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\tlog_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\tlog_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.tlog	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\tlog_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2584	AcroRd32.exe
2584	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2728	2508	cmd.exe	29
PID 2508 wrote to memory of 2728	2508	cmd.exe	29
PID 2508 wrote to memory of 2728	2508	cmd.exe	29
PID 2728 wrote to memory of 2584	2728	rundll32.exe	30
PID 2728 wrote to memory of 2584	2728	rundll32.exe	30
PID 2728 wrote to memory of 2584	2728	rundll32.exe	30
PID 2728 wrote to memory of 2584	2728	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Teletubbies3.exe-Malware-main\Teletubbies3-safety\Teletubbies3\Release\Teletubb.c828e1ed.tlog\link.read.1.tlog
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Teletubbies3.exe-Malware-main\Teletubbies3-safety\Teletubbies3\Release\Teletubb.c828e1ed.tlog\link.read.1.tlog
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Teletubbies3.exe-Malware-main\Teletubbies3-safety\Teletubbies3\Release\Teletubb.c828e1ed.tlog\link.read.1.tlog"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
58b0096e77f1698c124c62e98ebcc22b

SHA1
2a3aa4e8289db6056882261b4f91a18c63f058d7

SHA256
cb3c89e433a31f7894ad72568946644f9dc16dcf8eabaece3b9eaa012dd157a0

SHA512
de5f7db4c730087158201d5309ff36497097c346801a64722fca1d6a78275eb2e8772bf83e2dc0c710b32f431b26c9e517a800800647ae0383c205bcec147065

Download Submit