c64078d83451736e26ad57cde3cca028d01569e1ab49c166539cb70a53334de0

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Luna-Grabber-main/README.md
Size

4KB
MD5

6df931afa8d95a6ec5ca876f5f4beabf
SHA1

9d7a4e91c2b135e55e3a80d3c25d2329403bfa9c
SHA256

78378e01fbad32c566879f5d3ec46c2cf1072f1577d60e3627d6643f5d9bbdc3
SHA512

ab3bd32de39523a3db2e8cc976379db31ae1c327e36e3b2816bc92c78425b99a9b6204f374ed20320856ff5238d313849e237ef6a56f81fdf1421859185deac3
SSDEEP

96:cIdEekYRkDkKk/NGFXZ2dAvBmVKr7BkCU5vOYNER:cb/I11GBkZqYxER

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2676	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2676	AcroRd32.exe
2676	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1428	1988	cmd.exe	29
PID 1988 wrote to memory of 1428	1988	cmd.exe	29
PID 1988 wrote to memory of 1428	1988	cmd.exe	29
PID 1428 wrote to memory of 2676	1428	rundll32.exe	30
PID 1428 wrote to memory of 2676	1428	rundll32.exe	30
PID 1428 wrote to memory of 2676	1428	rundll32.exe	30
PID 1428 wrote to memory of 2676	1428	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
60e868362e90e622faa31b0fe19f461e

SHA1
8eed444e1c43c0e661501f526d565bd67a134414

SHA256
09d577521f4599cbfe9afc459746a2881c5b77b422360842230778b7eed36df8

SHA512
a371af814313cb3195c00aee2d069fad0acd9d4b9297731c07c9785646214fd9ba93805f5622308bfa5fc1b49a48ae06acc5b1c93b88f9a64c2d0c9348706de2

Download Submit