Overview
overview
10Static
static
1b3c5e464e4...e3.zip
windows7-x64
1b3c5e464e4...e3.zip
windows10-2004-x64
1INVOICE#BU...03.vhd
windows7-x64
3INVOICE#BU...03.vhd
windows10-2004-x64
3$RECYCLE.B...2Y.lnk
windows7-x64
3$RECYCLE.B...2Y.lnk
windows10-2004-x64
3$RECYCLE.B...CZ.url
windows7-x64
1$RECYCLE.B...CZ.url
windows10-2004-x64
1$RECYCLE.B...JO.url
windows7-x64
1$RECYCLE.B...JO.url
windows10-2004-x64
1$RECYCLE.B...G6.lnk
windows7-x64
3$RECYCLE.B...G6.lnk
windows10-2004-x64
3$RECYCLE.B...O0.cmd
windows7-x64
1$RECYCLE.B...O0.cmd
windows10-2004-x64
1$RECYCLE.B...21.txt
windows7-x64
1$RECYCLE.B...21.txt
windows10-2004-x64
1$RECYCLE.B...65.vhd
windows7-x64
3$RECYCLE.B...65.vhd
windows10-2004-x64
3$RECYCLE.B...2Y.lnk
windows7-x64
3$RECYCLE.B...2Y.lnk
windows10-2004-x64
3$RECYCLE.B...CZ.url
windows7-x64
1$RECYCLE.B...CZ.url
windows10-2004-x64
1$RECYCLE.B...JO.url
windows7-x64
1$RECYCLE.B...JO.url
windows10-2004-x64
1$RECYCLE.B...G6.lnk
windows7-x64
3$RECYCLE.B...G6.lnk
windows10-2004-x64
6$RECYCLE.B...O0.cmd
windows7-x64
1$RECYCLE.B...O0.cmd
windows10-2004-x64
10$RECYCLE.B...65.vhd
windows7-x64
3$RECYCLE.B...65.vhd
windows10-2004-x64
3$RECYCLE.B...op.ini
windows7-x64
1$RECYCLE.B...op.ini
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
25-03-2024 14:35
Static task
static1
Behavioral task
behavioral1
Sample
b3c5e464e43d7db2432f3e28de75bd0eee8fa7a2b7b6fef7134e7115d6681be3.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b3c5e464e43d7db2432f3e28de75bd0eee8fa7a2b7b6fef7134e7115d6681be3.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
INVOICE#BUSAPOMKDS03.vhd
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
INVOICE#BUSAPOMKDS03.vhd
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$RECYCLE.BIN/$I47GN2Y.lnk
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$RECYCLE.BIN/$I47GN2Y.lnk
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
$RECYCLE.BIN/$I6AKHCZ.url
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$RECYCLE.BIN/$I6AKHCZ.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$RECYCLE.BIN/$I9BVFJO.url
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$RECYCLE.BIN/$I9BVFJO.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$RECYCLE.BIN/$IAEXCG6.lnk
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$RECYCLE.BIN/$IAEXCG6.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$RECYCLE.BIN/$IAH62O0.cmd
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$RECYCLE.BIN/$IAH62O0.cmd
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$RECYCLE.BIN/$IFTQZ21.txt
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$RECYCLE.BIN/$IFTQZ21.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
$RECYCLE.BIN/$ITQTF65.vhd
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
$RECYCLE.BIN/$ITQTF65.vhd
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
$RECYCLE.BIN/$R47GN2Y.lnk
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
$RECYCLE.BIN/$R47GN2Y.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
$RECYCLE.BIN/$R6AKHCZ.url
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$RECYCLE.BIN/$R6AKHCZ.url
Resource
win10v2004-20240319-en
Behavioral task
behavioral23
Sample
$RECYCLE.BIN/$R9BVFJO.url
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$RECYCLE.BIN/$R9BVFJO.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
$RECYCLE.BIN/$RAEXCG6.lnk
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$RECYCLE.BIN/$RAEXCG6.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
$RECYCLE.BIN/$RAH62O0.cmd
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$RECYCLE.BIN/$RAH62O0.cmd
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
$RECYCLE.BIN/$RTQTF65.vhd
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
$RECYCLE.BIN/$RTQTF65.vhd
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
$RECYCLE.BIN/desktop.ini
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$RECYCLE.BIN/desktop.ini
Resource
win10v2004-20240226-en
General
-
Target
$RECYCLE.BIN/$RTQTF65.vhd
-
Size
6.0MB
-
MD5
fd4979108b9587139173f02f7f0e6797
-
SHA1
6db7400102360fa2644e003eaeb96315d041c36c
-
SHA256
e1d549111b59ebb819d83440133ee876947261f3e8c2a78594de228a77de1b8f
-
SHA512
52f2fb184bf01ae3b4459cf4e54891d0efe7f24b156d98f897709c9108a709d7e2bda545fdb3cf34bf07f0018d94f1e9ed357682f513478064b434f6e34d951c
-
SSDEEP
1536:C+PCBK4J9mILDGlGC6H9S5QZ9BiLJfhHB+ZVBGIg47x1eDBSMi+1WSxlul7W4iui:JlGC6H45QtiLJfhB+ZVBGIXcSI
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\vhd_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.vhd rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\vhd_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\vhd_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\vhd_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.vhd\ = "vhd_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\vhd_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\vhd_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2664 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2664 AcroRd32.exe 2664 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1724 wrote to memory of 2576 1724 cmd.exe rundll32.exe PID 1724 wrote to memory of 2576 1724 cmd.exe rundll32.exe PID 1724 wrote to memory of 2576 1724 cmd.exe rundll32.exe PID 2576 wrote to memory of 2664 2576 rundll32.exe AcroRd32.exe PID 2576 wrote to memory of 2664 2576 rundll32.exe AcroRd32.exe PID 2576 wrote to memory of 2664 2576 rundll32.exe AcroRd32.exe PID 2576 wrote to memory of 2664 2576 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$RTQTF65.vhd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$RTQTF65.vhd2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$RTQTF65.vhd"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD52749900d82f4f9bafb9f033f945fbe75
SHA1909041d4079ebca8955f8251c8c2a972884c47a7
SHA2564d200ca42b832377f93ab5485896418003b997b2de8d4e0795250c61f7b5b551
SHA5122992b4c2b0b7aac1afb6c0d2f2b07ad52c3f122ec91d4d6051eed5ed2138dd95147e065f34bf751a775c1a32bf099029f98006af628670091b515cc3110cc0a7