0ecfa9e9370f383a669aad9db9a28109c24226496b519e7383713c7c1deaf861

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-03-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chronos/.git/hooks/prepare-commit-msg.sample
Size

1KB
MD5

2b5c047bdb474555e1787db32b2d2fc5
SHA1

2584806ba147152ae005cb675aa4f01d5d068456
SHA256

e9ddcaa4189fddd25ed97fc8c789eca7b6ca16390b2392ae3276f0c8e1aa4619
SHA512

50ec8a0dd98427e80a82a8d8ce44462a845876e1594c9d0e89483ce9a8aaad616edea0e5c45c1bb69d8fe7f520c6f2260d6fa350d77b400899c3ae375e965bfb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.sample\ = "sample_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\sample_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\sample_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.sample	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\sample_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\sample_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\sample_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\sample_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2432 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2432 AcroRd32.exe
2432 AcroRd32.exe

pid	process
2432	AcroRd32.exe

pid	process
2432	AcroRd32.exe
2432	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2140 wrote to memory of 2656	2140	cmd.exe	rundll32.exe
PID 2140 wrote to memory of 2656	2140	cmd.exe	rundll32.exe
PID 2140 wrote to memory of 2656	2140	cmd.exe	rundll32.exe
PID 2656 wrote to memory of 2432	2656	rundll32.exe	AcroRd32.exe
PID 2656 wrote to memory of 2432	2656	rundll32.exe	AcroRd32.exe
PID 2656 wrote to memory of 2432	2656	rundll32.exe	AcroRd32.exe
PID 2656 wrote to memory of 2432	2656	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Chronos\.git\hooks\prepare-commit-msg.sample
1⤵
- Suspicious use of WriteProcessMemory
PID:2140

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Chronos\.git\hooks\prepare-commit-msg.sample
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2656

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Chronos\.git\hooks\prepare-commit-msg.sample"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2432

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
32e9d061630acf7ad243d17e16350e37

SHA1
0873d2f23de89b093f4f9c98d64c2a5889740c40

SHA256
127f6556f004a7424aa5697d642619d019eaa0bae22ef3d54626e389f961f9c0

SHA512
976346adab1f7aa762af4d2786f5fb19c6c2abb417d598a81618de91bb4a01d0341deab62ba37b45e37f4a52bcc31c3806ab729684a7a4d2730c2b988be6a0d9

Download Submit