f26f9a618a04f3af4ddbc73d7dc278b603f159e33ebd72442b4aa1bfcfe1824b

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Teletubbies3.exe-Malware-main/Teletubbies3-safety/Teletubbies3/Release/Teletubb.c828e1ed.tlog/link.write.1.tlog
Size

996B
MD5

7281a50c95a7499dbd66aa9b700da98e
SHA1

795d638cf8c3f32d2baf5c0532c35776116129d3
SHA256

f6746f027e3e554dcd5ce681a50e9ac72d8e149fe0bcc4a2de482923166346f0
SHA512

7dbfe9784a723b0b6186e81f403c8cbb1a1d5e73f06000ba5f8ccbd0c93adc5c94670fbd251504274e8f334f2924e8c184edaa8c9d45189d0a7d3b557f361d7c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\tlog_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\tlog_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\tlog_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.tlog	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.tlog\ = "tlog_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\tlog_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\tlog_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\tlog_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2744	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2744	AcroRd32.exe
2744	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2584	2916	cmd.exe	29
PID 2916 wrote to memory of 2584	2916	cmd.exe	29
PID 2916 wrote to memory of 2584	2916	cmd.exe	29
PID 2584 wrote to memory of 2744	2584	rundll32.exe	30
PID 2584 wrote to memory of 2744	2584	rundll32.exe	30
PID 2584 wrote to memory of 2744	2584	rundll32.exe	30
PID 2584 wrote to memory of 2744	2584	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Teletubbies3.exe-Malware-main\Teletubbies3-safety\Teletubbies3\Release\Teletubb.c828e1ed.tlog\link.write.1.tlog
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Teletubbies3.exe-Malware-main\Teletubbies3-safety\Teletubbies3\Release\Teletubb.c828e1ed.tlog\link.write.1.tlog
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Teletubbies3.exe-Malware-main\Teletubbies3-safety\Teletubbies3\Release\Teletubb.c828e1ed.tlog\link.write.1.tlog"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
be4f15e92667e5d4cc346af8467c3cf6

SHA1
879e2673ea75a54fa83fdc951dd81a0d9e70b7ff

SHA256
3b6f4427541e80f92d635441bad023f4957aa1b4df30621649d1026010dca998

SHA512
54c41ebc9515506738f43488198706ccebc062711c9a8bbb0d122a473cd330b9fd2d17cde6253ded6c7163dc9b2eadd8185024284faabb21f256316edd89ba4f

Download Submit