d9c6ba096bc85554d5e3adff83edb5c97c179bd28f21bff3c4969786be9daa36

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
koalahook-main/src/license/TERMS.md
Size 83B
Sample240419-2e441aab2t
SHA256 3cb4ced8fcd7f390ba8b7a1b082f97b082504a75c116d58aed6de1f8d85b22d2
MD5 cf388e8f90be6052aa23a7ff3901e2ec
SHA1 cf4b808ce659e4a6a29ffb8b7a9f0c7e273d70c2
SHA512 d1212c06128493c95d8aaaccd84d7e6456f19685e0343338b81c40564f73431e71a3d099dd9f6dbaff6d4fb000c50cc6e646082197d5087fa7a0ae253b474565
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\md_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2520	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2520	AcroRd32.exe
2520	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2596	1652	cmd.exe	29
PID 1652 wrote to memory of 2596	1652	cmd.exe	29
PID 1652 wrote to memory of 2596	1652	cmd.exe	29
PID 2596 wrote to memory of 2520	2596	rundll32.exe	30
PID 2596 wrote to memory of 2520	2596	rundll32.exe	30
PID 2596 wrote to memory of 2520	2596	rundll32.exe	30
PID 2596 wrote to memory of 2520	2596	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\koalahook-main\src\license\TERMS.md
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\koalahook-main\src\license\TERMS.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\koalahook-main\src\license\TERMS.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 33b09771dfbd8b967c31bae3d7d18dca91f175e0315881078bf24ae9afc194f6
MD5 b83b648939a2665c4ed970b685a9d7b8
SHA1 c2a20fa9eaa18243108962aaaedabc84dadcb583
SHA512 7aad9f2d314d8f342d93ef025b3addd72acf34a856f6c19d2d52060b362760bcee91e2c76a8925606a0004c5ca423a019e5a87f11daf8df8c40a83d71ad8d564
MD5 SHA1 SHA512

Submit Download