506f38d62951d1ca74d169e4b4517a320bab7d94eb710f2e568743ff99905f15

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 08:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

MC-Session-Stealer-main/.gitignore
Size

143B
MD5

e752542249b7c54bdebfbf45e57ddef7
SHA1

69f3839f503662d7b8835ac7bf6293dc5ebfe38d
SHA256

fa08452b6084dc915421a298d6d51e02f4b447101e5db20032c8c417602a07ff
SHA512

943313c5f6ac16273fab2df1ce1ec0688421fd2b1ec379b26eb597bc6f5f6a3620e040fd85d9ce8d923e9cd8f5f8982998e9943bb6a80eadff4bf744537aec79

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\gitignore_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.gitignore	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\gitignore_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\gitignore_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\gitignore_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.gitignore\ = "gitignore_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\gitignore_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\gitignore_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2264	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2264	AcroRd32.exe
2264	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2560	1288	cmd.exe	29
PID 1288 wrote to memory of 2560	1288	cmd.exe	29
PID 1288 wrote to memory of 2560	1288	cmd.exe	29
PID 2560 wrote to memory of 2264	2560	rundll32.exe	30
PID 2560 wrote to memory of 2264	2560	rundll32.exe	30
PID 2560 wrote to memory of 2264	2560	rundll32.exe	30
PID 2560 wrote to memory of 2264	2560	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MC-Session-Stealer-main\.gitignore
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MC-Session-Stealer-main\.gitignore
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MC-Session-Stealer-main\.gitignore"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
139af9078b44543827b931fed341cde8

SHA1
f0fa74c9f0b45acda3d2afee0fdd4b077be6a89b

SHA256
3bed9134fcef08688aa1aa658869a3f8c6f49dacc00e5c6cb4c406dfe2889209

SHA512
c015d8f670a98e15423bd82e825e7a8c2be5632b9a66701266488c0d318408d83cdaa1f89dec70bdac40c2d8665cf4a9fbffd1ad2e50c7dfe1e37160043a2f19

Download Submit