c64078d83451736e26ad57cde3cca028d01569e1ab49c166539cb70a53334de0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Luna-Grabber-main/.github/ISSUE_TEMPLATE/bug_report.md
Size

541B
MD5

19dcdd1cd8633266aa38efdac488f7c3
SHA1

db457b0ca0fad4ed5fa6bc749f72feb865418df9
SHA256

e214fac2913661096600939e4cb3cfdd747d0ebbc13784e468e5afaf2601b322
SHA512

75d940fbe54c7faa73bb6ce394b166d653c6873635bcb28fd3307f601ac69ba93b0f7001c52bb299771a305a77606f090b70bae91b7271dcd8170b1d8ede2588

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.md	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\md_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2488	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2488	AcroRd32.exe
2488	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2636	1904	cmd.exe	29
PID 1904 wrote to memory of 2636	1904	cmd.exe	29
PID 1904 wrote to memory of 2636	1904	cmd.exe	29
PID 2636 wrote to memory of 2488	2636	rundll32.exe	30
PID 2636 wrote to memory of 2488	2636	rundll32.exe	30
PID 2636 wrote to memory of 2488	2636	rundll32.exe	30
PID 2636 wrote to memory of 2488	2636	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\.github\ISSUE_TEMPLATE\bug_report.md
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\.github\ISSUE_TEMPLATE\bug_report.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\.github\ISSUE_TEMPLATE\bug_report.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6f048f5fc48b2f8b0dcbd7d207eb6611

SHA1
21894f3636957090a8fe97095286f02a30844582

SHA256
2a6b6c9743dfd5c5531730972d5c57c58bea90fd0d9d402d26921e38ae65757b

SHA512
1336107132e6d27ba79838de246c31da0171951dfba76052ba5a86e4c63f326bf738d6d0d60ab6e5cf4bbbbb1598aa84def39e848fc69c69842d1d7bedfead1d

Download Submit