40f1b71a057db9ca86a4d699e827a7d98f530044bfe37361d4a6f16b8057f2a9

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

htdocs/log/api/login/index.php
Size

9B
MD5

ed0384ad29e60110b310a02e95287ee6
SHA1

9c8a8626c44946691f545b212909180320bbb17a
SHA256

783990d11819c473ccf153a73ac1edc2bebb366b9d432bf9bb0df07570466998
SHA512

30569fc93937bec41f4362cdaf0427b87a432fab703715051ecbbd7e54ee69ce297533bafd5d7c01320497107ec71d4c061adbb11634d06480083e6c66aee8b3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\php_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\php_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.php\ = "php_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\php_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.php	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\php_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\php_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\php_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2540	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2540	AcroRd32.exe
2540	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2576	2352	cmd.exe	30
PID 2352 wrote to memory of 2576	2352	cmd.exe	30
PID 2352 wrote to memory of 2576	2352	cmd.exe	30
PID 2576 wrote to memory of 2540	2576	rundll32.exe	31
PID 2576 wrote to memory of 2540	2576	rundll32.exe	31
PID 2576 wrote to memory of 2540	2576	rundll32.exe	31
PID 2576 wrote to memory of 2540	2576	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\htdocs\log\api\login\index.php
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\htdocs\log\api\login\index.php
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\htdocs\log\api\login\index.php"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
363b932b83467ac6cd89fab5137bd5a8

SHA1
85edc8b5c9a7b75916415feddc89650590ffc910

SHA256
14945af75b2e6308037ab28915164fcd29ff6a6dbf34012cddf1664eacab33e7

SHA512
b0c9d20c22645d639b052a51615a94f0e3e761e7e2d831c45ae2ba556755327ee6b7c53a060a98daa43b70aa66f406388f781348c7d8b6022e49f5d6cf0f7ae4

Download Submit