761cc48d25bd9921b8d978fd254d2795f665c7e0a8eb2e9210f4fedef15a4906

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

niggerspoofa.pdb
Size

43KB
MD5

ab54c1b0887ca205bbf059ba68dac913
SHA1

a62dfd3c016f7dda54fe52395a7663db2c0e9639
SHA256

37b43b319de3516bce0f25aab174465f9c6dbc418c314dcc33641d7d5b98f6eb
SHA512

9be61ce3099dc764ad6e16aec5462061178517eb70a94c7bf77166609ebd38a843b4dca5eab4a022812c438146d63f0fece56ca0fd0c4353b53aaa72b2a46211
SSDEEP

384:ES2UFt2UfQ2FBgB4riEC7AVBEC7Abergc9FnUPxs5fuF8EC7AaFJXQ20g4A:ES2UFt2UfQ2FBg65lwwf64dQ20g4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pdb\ = "pdb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pdb	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2808	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2808	AcroRd32.exe
2808	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2456	1688	cmd.exe	29
PID 1688 wrote to memory of 2456	1688	cmd.exe	29
PID 1688 wrote to memory of 2456	1688	cmd.exe	29
PID 2456 wrote to memory of 2808	2456	rundll32.exe	30
PID 2456 wrote to memory of 2808	2456	rundll32.exe	30
PID 2456 wrote to memory of 2808	2456	rundll32.exe	30
PID 2456 wrote to memory of 2808	2456	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\niggerspoofa.pdb
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\niggerspoofa.pdb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\niggerspoofa.pdb"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1e04535833b0c15f189f2f55ddea3a82

SHA1
d90ac3f89c1390334e83ccfdbd04d5d453e8b0eb

SHA256
a6eb99e7e7329a4656bafab7ace1dc2ebf284b62f3eb8f26ed9741cbcc87a228

SHA512
cc31a3cef3a610ef00626d53d11125a61d5c6797dec43b289ab881388cca460dc1f89be5dc6a5e1244a6fb0e6d3632aa981158153a02cfd55b045816e0ecce35

Download Submit