Overview
overview
10Static
static
1b3c5e464e4...e3.zip
windows7-x64
1b3c5e464e4...e3.zip
windows10-2004-x64
1INVOICE#BU...03.vhd
windows7-x64
3INVOICE#BU...03.vhd
windows10-2004-x64
3$RECYCLE.B...2Y.lnk
windows7-x64
3$RECYCLE.B...2Y.lnk
windows10-2004-x64
3$RECYCLE.B...CZ.url
windows7-x64
1$RECYCLE.B...CZ.url
windows10-2004-x64
1$RECYCLE.B...JO.url
windows7-x64
1$RECYCLE.B...JO.url
windows10-2004-x64
1$RECYCLE.B...G6.lnk
windows7-x64
3$RECYCLE.B...G6.lnk
windows10-2004-x64
3$RECYCLE.B...O0.cmd
windows7-x64
1$RECYCLE.B...O0.cmd
windows10-2004-x64
1$RECYCLE.B...21.txt
windows7-x64
1$RECYCLE.B...21.txt
windows10-2004-x64
1$RECYCLE.B...65.vhd
windows7-x64
3$RECYCLE.B...65.vhd
windows10-2004-x64
3$RECYCLE.B...2Y.lnk
windows7-x64
3$RECYCLE.B...2Y.lnk
windows10-2004-x64
3$RECYCLE.B...CZ.url
windows7-x64
1$RECYCLE.B...CZ.url
windows10-2004-x64
1$RECYCLE.B...JO.url
windows7-x64
1$RECYCLE.B...JO.url
windows10-2004-x64
1$RECYCLE.B...G6.lnk
windows7-x64
3$RECYCLE.B...G6.lnk
windows10-2004-x64
6$RECYCLE.B...O0.cmd
windows7-x64
1$RECYCLE.B...O0.cmd
windows10-2004-x64
10$RECYCLE.B...65.vhd
windows7-x64
3$RECYCLE.B...65.vhd
windows10-2004-x64
3$RECYCLE.B...op.ini
windows7-x64
1$RECYCLE.B...op.ini
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
25-03-2024 14:35
Static task
static1
Behavioral task
behavioral1
Sample
b3c5e464e43d7db2432f3e28de75bd0eee8fa7a2b7b6fef7134e7115d6681be3.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b3c5e464e43d7db2432f3e28de75bd0eee8fa7a2b7b6fef7134e7115d6681be3.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
INVOICE#BUSAPOMKDS03.vhd
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
INVOICE#BUSAPOMKDS03.vhd
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$RECYCLE.BIN/$I47GN2Y.lnk
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$RECYCLE.BIN/$I47GN2Y.lnk
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
$RECYCLE.BIN/$I6AKHCZ.url
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$RECYCLE.BIN/$I6AKHCZ.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$RECYCLE.BIN/$I9BVFJO.url
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$RECYCLE.BIN/$I9BVFJO.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$RECYCLE.BIN/$IAEXCG6.lnk
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$RECYCLE.BIN/$IAEXCG6.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$RECYCLE.BIN/$IAH62O0.cmd
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$RECYCLE.BIN/$IAH62O0.cmd
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$RECYCLE.BIN/$IFTQZ21.txt
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$RECYCLE.BIN/$IFTQZ21.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
$RECYCLE.BIN/$ITQTF65.vhd
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
$RECYCLE.BIN/$ITQTF65.vhd
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
$RECYCLE.BIN/$R47GN2Y.lnk
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
$RECYCLE.BIN/$R47GN2Y.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
$RECYCLE.BIN/$R6AKHCZ.url
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$RECYCLE.BIN/$R6AKHCZ.url
Resource
win10v2004-20240319-en
Behavioral task
behavioral23
Sample
$RECYCLE.BIN/$R9BVFJO.url
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$RECYCLE.BIN/$R9BVFJO.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
$RECYCLE.BIN/$RAEXCG6.lnk
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$RECYCLE.BIN/$RAEXCG6.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
$RECYCLE.BIN/$RAH62O0.cmd
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$RECYCLE.BIN/$RAH62O0.cmd
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
$RECYCLE.BIN/$RTQTF65.vhd
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
$RECYCLE.BIN/$RTQTF65.vhd
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
$RECYCLE.BIN/desktop.ini
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$RECYCLE.BIN/desktop.ini
Resource
win10v2004-20240226-en
General
-
Target
$RECYCLE.BIN/$ITQTF65.vhd
-
Size
52B
-
MD5
5c4658d0c26e73e822805cd541661a77
-
SHA1
45d2b460c1b8395401fd60b26b8f398f5cfbcbf5
-
SHA256
8f3b7422617b49f01037d7f18aeeec7892d95a804cc220228ded61e3fbb7bb30
-
SHA512
d8e455d594bf16b279f082aefccb939440619a0da8339534873dfbbddd3cc2880e2f7c6b2fdf9999ee48455b4c139750403ed9b8c2e6c82da0bdeb522b196002
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\vhd_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.vhd\ = "vhd_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.vhd rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\vhd_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\vhd_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\vhd_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\vhd_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\vhd_auto_file\ rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2684 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2684 AcroRd32.exe 2684 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2972 wrote to memory of 2504 2972 cmd.exe rundll32.exe PID 2972 wrote to memory of 2504 2972 cmd.exe rundll32.exe PID 2972 wrote to memory of 2504 2972 cmd.exe rundll32.exe PID 2504 wrote to memory of 2684 2504 rundll32.exe AcroRd32.exe PID 2504 wrote to memory of 2684 2504 rundll32.exe AcroRd32.exe PID 2504 wrote to memory of 2684 2504 rundll32.exe AcroRd32.exe PID 2504 wrote to memory of 2684 2504 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$ITQTF65.vhd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$ITQTF65.vhd2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$ITQTF65.vhd"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5138ff0573be3e545e5ac100689fa2c0e
SHA1d3138323d36a246106a8cd838744b10ca3033944
SHA256311003bf27d5d0ec62c594a9a5e1ddcd3a6035f7968eb9d27a9fa7b1a3893d11
SHA5129983b32c7d5cb52b64cb2fe90505414da2d6bbd01a0b93229d16eefab7ada617ef974266fe19a4c23b1812dff000606d0fb5aed41032142b2a6842470c11c273