d6193ac848e9413eb2a9158c9b50ddacaccc2877945b7f9d0bc5c387e1cc1d81

Analysis

max time kernel
136s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Multi Giftcard Gen/README.md
Size

819B
MD5

38c230403c2718404e7ec310b7ec3ba0
SHA1

f0ec09315f9d290005e0a778bdb2a1b061dea997
SHA256

0560fbdc579e282543ca1b69c66568e4b73dade606caa86c0fd77a3d5a89fdc1
SHA512

6f05590d479fa5f363fd69b5acb26a4b163db3b4b6efda6791b48076aff08df0e0804b652e9d51b1b6958e7fd1f2f2822508ce392e26f9b2a43a720276775e51

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\md_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\md_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2912	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2912	AcroRd32.exe
2912	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2764	2560	cmd.exe	28
PID 2560 wrote to memory of 2764	2560	cmd.exe	28
PID 2560 wrote to memory of 2764	2560	cmd.exe	28
PID 2764 wrote to memory of 2912	2764	rundll32.exe	31
PID 2764 wrote to memory of 2912	2764	rundll32.exe	31
PID 2764 wrote to memory of 2912	2764	rundll32.exe	31
PID 2764 wrote to memory of 2912	2764	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Multi Giftcard Gen\README.md"
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Multi Giftcard Gen\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Multi Giftcard Gen\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
db11e3a9002d7283a9724e67afafebf7

SHA1
cd3696aa67f19c32fb2be036a1e9fd285e7e01d0

SHA256
67562efae5bf7e6aab5fc1ed8621e4065c93ff2bda906881adadfda2fe30d306

SHA512
c99a6c79edc5b8f7091704bc13e53dec77847a46e2d20a8dd49f45b58ea1dd2e466503fe2ff2f5c005e2934731109a830c7dbf25ae6135ab438032f79d480959

Download Submit