1d5550a21ad07ce2b2916954ed7951a80907aec0a0600a7566f9af51d0ee05ea

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RO-exec v2.0/configs/dahood.cfg
Size

996B
MD5

9489291979d19765ca4ba990df16b917
SHA1

dde51d149d847557cfb783500f3d630bf18cb7ca
SHA256

6a25e77b4c712d7ab36c5f3e50f5e65a313d699942081bc89079200824166e16
SHA512

be5c4cf4d60ad05de15458cb3fae24466640d97d47bd13be50e871b9e0e48135a63e938142370af30714b34e3ae37a03b9d8ef42162329b590b5e07d7e23191a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cfg_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cfg_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cfg_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.cfg	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.cfg\ = "cfg_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cfg_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cfg_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cfg_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2716	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2716	AcroRd32.exe
2716	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2660	2172	cmd.exe	29
PID 2172 wrote to memory of 2660	2172	cmd.exe	29
PID 2172 wrote to memory of 2660	2172	cmd.exe	29
PID 2660 wrote to memory of 2716	2660	rundll32.exe	30
PID 2660 wrote to memory of 2716	2660	rundll32.exe	30
PID 2660 wrote to memory of 2716	2660	rundll32.exe	30
PID 2660 wrote to memory of 2716	2660	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\RO-exec v2.0\configs\dahood.cfg"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RO-exec v2.0\configs\dahood.cfg
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RO-exec v2.0\configs\dahood.cfg"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fff62bc6a8ae92cfa8abc7eaa6b52acd

SHA1
682571f6b9715b0bfac9f33f0f72a600301cfaa6

SHA256
b2754a6a7f14aa3cbd1582af372855e20551e6ca910fec24195fe91b0862196d

SHA512
e33976d08d040ad9246caafb6133937d4965f89f325e539fd61ffc29fa21300d41358f777e9f3ef78de096a676e1078d2424a99e6d8346dd70ff090ac0035b36

Download Submit