Overview
overview
10Static
static
10Release (1).rar
windows7-x64
3Release (1).rar
windows10-2004-x64
3Guna.UI2.dll
windows7-x64
1Guna.UI2.dll
windows10-2004-x64
1IDTOIPBYR_0.deps.json
windows7-x64
3IDTOIPBYR_0.deps.json
windows10-2004-x64
3IDTOIPBYR_0.exe
windows7-x64
10IDTOIPBYR_0.exe
windows10-2004-x64
10IDTOIPBYR_0.exe
windows7-x64
10IDTOIPBYR_0.exe
windows10-2004-x64
10IDTOIPBYR_0.pdb
windows7-x64
3IDTOIPBYR_0.pdb
windows10-2004-x64
3IDTOIPBYR_...g.json
windows7-x64
3IDTOIPBYR_...g.json
windows10-2004-x64
3System.Management.dll
windows7-x64
1System.Management.dll
windows10-2004-x64
1Analysis
-
max time kernel
359s -
max time network
360s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 00:05
Behavioral task
behavioral1
Sample
Release (1).rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Release (1).rar
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
Guna.UI2.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
Guna.UI2.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
IDTOIPBYR_0.deps.json
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
IDTOIPBYR_0.deps.json
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
IDTOIPBYR_0.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
IDTOIPBYR_0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
IDTOIPBYR_0.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
IDTOIPBYR_0.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
IDTOIPBYR_0.pdb
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
IDTOIPBYR_0.pdb
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
IDTOIPBYR_0.runtimeconfig.json
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
IDTOIPBYR_0.runtimeconfig.json
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
System.Management.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
System.Management.dll
Resource
win10v2004-20240419-en
General
-
Target
IDTOIPBYR_0.deps.json
-
Size
2KB
-
MD5
a894cb3d393263325741b472605a088e
-
SHA1
41b9c4ff3c761bb362457cb5225f136ca8a93beb
-
SHA256
56ab1b179ec0bafceca428c50b5a887c0708914e68c2c1e8c120811215890724
-
SHA512
c4169a125a0b3add6cbbce853229bfdad1cbc7fc2fd9580ec9851e42d91d12d8a729045623f934f19bcdf21ae23328d8516f1abfc29fc7530157712df6e2cbf6
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.json rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2568 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2568 AcroRd32.exe 2568 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2260 wrote to memory of 2640 2260 cmd.exe rundll32.exe PID 2260 wrote to memory of 2640 2260 cmd.exe rundll32.exe PID 2260 wrote to memory of 2640 2260 cmd.exe rundll32.exe PID 2640 wrote to memory of 2568 2640 rundll32.exe AcroRd32.exe PID 2640 wrote to memory of 2568 2640 rundll32.exe AcroRd32.exe PID 2640 wrote to memory of 2568 2640 rundll32.exe AcroRd32.exe PID 2640 wrote to memory of 2568 2640 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.deps.json1⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.deps.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.deps.json"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e9912ef9827425240b0a0e311a2780d5
SHA1fe58b01d2feb454d09030e60226b3d78cb3f2360
SHA25619dec488f486b9daf5d595dd88b5160358d4814c42c33c76d4b3f681037987b6
SHA512006cb434107909ef689832a1eaa3ac9aa7b027aef053e527cce3fffee5a97ebd07aea4966fff848deb3aa5bac1c75e6aaeee5ea9b0f798fe979309bf919705f3