7a0c39492d13850bf2d6926ea67da73f89b8e16d2b5561f8ddfc604b1507cff1

Analysis

max time kernel
1105s
max time network
847s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 13:33

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

★ Full Models No-Recoil★ [2018] by Sami khalil/models/v_famas.mdl
Size

229KB
MD5

5f8f5d01b1ce72308b30b38b210078ad
SHA1

7a2ea961f246d54629d747a98760fc15dc364214
SHA256

9a054ce1ab569bd43160f001c567036278d4d17cadec75e15a7f96a3223cb93f
SHA512

8ee7c71ff7f3244b7639d5f99e0ec75a218f2086c70d2bd77db242a39eccafcddb9aef7465d139873b39b378ef1d9edc9f6173af58ebbc34801f0a6893afa4b5
SSDEEP

6144:kHCfO2FAPHhWtUNhRORJsqEZDDMym6kLcB:9O2FA5GEsi7DMym9LE

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 32 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000	winlogon.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.mdl	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.mdl\ = "mdl_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\mdl_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\mdl_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\mdl_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\mdl_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\mdl_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\mdl_auto_file	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2680	AcroRd32.exe
1288	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1288	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe
1288	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2680	AcroRd32.exe
2680	AcroRd32.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2580	1704	cmd.exe	29
PID 1704 wrote to memory of 2580	1704	cmd.exe	29
PID 1704 wrote to memory of 2580	1704	cmd.exe	29
PID 2580 wrote to memory of 2680	2580	rundll32.exe	30
PID 2580 wrote to memory of 2680	2580	rundll32.exe	30
PID 2580 wrote to memory of 2680	2580	rundll32.exe	30
PID 2580 wrote to memory of 2680	2580	rundll32.exe	30
PID 2240 wrote to memory of 608	2240	csrss.exe	40
PID 2240 wrote to memory of 608	2240	csrss.exe	40
PID 2208 wrote to memory of 608	2208	winlogon.exe	40
PID 2208 wrote to memory of 608	2208	winlogon.exe	40
PID 2208 wrote to memory of 608	2208	winlogon.exe	40
PID 2240 wrote to memory of 608	2240	csrss.exe	40
PID 2240 wrote to memory of 608	2240	csrss.exe	40
PID 2240 wrote to memory of 608	2240	csrss.exe	40
PID 2240 wrote to memory of 608	2240	csrss.exe	40
PID 2240 wrote to memory of 608	2240	csrss.exe	40
PID 2240 wrote to memory of 608	2240	csrss.exe	40
PID 2240 wrote to memory of 608	2240	csrss.exe	40
PID 2240 wrote to memory of 608	2240	csrss.exe	40

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\★ Full Models No-Recoil★ [2018] by Sami khalil\models\v_famas.mdl"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\★ Full Models No-Recoil★ [2018] by Sami khalil\models\v_famas.mdl
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\★ Full Models No-Recoil★ [2018] by Sami khalil\models\v_famas.mdl"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2680

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1288

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:2908

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x0
  2⤵
  PID:608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0481a4ffc01777e95dea3ff151dd9804

SHA1
c4e5649a34661059bd03578bcf8b983047a6f101

SHA256
8a66e6195ebb5f05318b31f2bfcb00334c4ce6b20453ea9cc5291e533fa381ae

SHA512
ae586de1c40e107663dd6b7cd01e5de68d61930cf0380a9ebd9a78e052120f108020aa1d9a15945141abb3a061e04bb0cb177e0c9520027f3bd5dca29d070021

Download Submit
memory/1288-41-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1288-42-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1288-43-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download