1d5550a21ad07ce2b2916954ed7951a80907aec0a0600a7566f9af51d0ee05ea

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RO-exec v2.0/configs/universal.cfg
Size

971B
MD5

3386ac6b55f3addf304f6e1cce51e7ca
SHA1

a7b4690e696a4d3721f6593a69cc1803ab5cd55a
SHA256

c90eef14c30d70d78bcf5a6fb1ede83befa1a7a6259f72d2134a63fdd65550c6
SHA512

794a276919ccb64733ca4a2568cb8befcea6e14f1e6e4af3100b668c87e45080860a3caa9000a28f9950a8d25d22ef67e79b26b642824e0f2192d7e6ab5cada9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\cfg_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.cfg\ = "cfg_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\cfg_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\cfg_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\cfg_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\cfg_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.cfg	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\cfg_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2432	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2432	AcroRd32.exe
2432	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2660	1908	cmd.exe	29
PID 1908 wrote to memory of 2660	1908	cmd.exe	29
PID 1908 wrote to memory of 2660	1908	cmd.exe	29
PID 2660 wrote to memory of 2432	2660	rundll32.exe	30
PID 2660 wrote to memory of 2432	2660	rundll32.exe	30
PID 2660 wrote to memory of 2432	2660	rundll32.exe	30
PID 2660 wrote to memory of 2432	2660	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\RO-exec v2.0\configs\universal.cfg"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RO-exec v2.0\configs\universal.cfg
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RO-exec v2.0\configs\universal.cfg"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
163dcc2eb8ebd25e70d3ca21cde50c67

SHA1
f2df89078171e4b7ac369b7635c762508a3d5489

SHA256
7f71f7974b75e1c4ff64f9de76386a9bc21a7a8274636a940c7441b2f6d2d34f

SHA512
25dfa000f9556fc2dd38ef36d9988b585a58d62ded7b2df998249fd5e7f3f018084e69c6fa2ad80e90789eb9f47dd0b1ede295c50322576d7765a465676f88d8

Download Submit