506f38d62951d1ca74d169e4b4517a320bab7d94eb710f2e568743ff99905f15

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MC-Session-Stealer-main/build.gradle
Size

362B
MD5

dd114a131f604a26e627c7cf022dfe02
SHA1

7c70c7383cd3300e63df88543f621b1eb27e5342
SHA256

e0efa054480f70baca2c9d1c099176cb21a11a2e351269d8ce83a45add22e9ae
SHA512

fac2809e2e48ef9ba11310e94622e8ddcc81cd63bc47d56f42785a1b4c14eaf0084ec6634cb66bdd5ec9c80e1af5ed7607e0d6e8a20635752efd745cd79a7395

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\gradle_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.gradle	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.gradle\ = "gradle_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\gradle_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\gradle_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\gradle_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\gradle_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\gradle_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2712	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2556	1740	cmd.exe	29
PID 1740 wrote to memory of 2556	1740	cmd.exe	29
PID 1740 wrote to memory of 2556	1740	cmd.exe	29
PID 2556 wrote to memory of 2712	2556	rundll32.exe	30
PID 2556 wrote to memory of 2712	2556	rundll32.exe	30
PID 2556 wrote to memory of 2712	2556	rundll32.exe	30
PID 2556 wrote to memory of 2712	2556	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MC-Session-Stealer-main\build.gradle
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MC-Session-Stealer-main\build.gradle
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MC-Session-Stealer-main\build.gradle"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ce05b497945a07a3b081788342911ca0

SHA1
27aab8c62fbd5ded4a3e80e9681c9a81f3a85bab

SHA256
eebf9575bd90a45d9a8fcc1f1a6ab02f983b8fdbbd13bd584f02ba17dcceae3e

SHA512
44b82486dde7d0b3f0ddf91c4aa890297d654f8e4da01929bc395bc5ea0f7b17231469cdb3959397047691e0981635013a6a0b29d5790191d02bea710faf0c50

Download Submit