e240bb62876617721332db51b1d9116c817cf6ef8664061675cd9d1e3e6f5aa2

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Netti-Nuker-main/README.md
Size

314B
MD5

a33437632faacac453d4e0d070b023bd
SHA1

7dc96237952fb756db6d50b6da72ec97c8486555
SHA256

8229935835d7699f571dbed3a6d45ccf62f304bda4c006bb1bf210680daf9191
SHA512

0e1997c7164f5e9a7e516c687b4bc2ff64a6e1ad789dc8a410ba57d5341d5741bb25a3dc3bd6624ad2359336bba8b35fc928ace59428db2a261b7a38801c2a3d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\md_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2648	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2648	AcroRd32.exe
2648	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2612	2300	cmd.exe	29
PID 2300 wrote to memory of 2612	2300	cmd.exe	29
PID 2300 wrote to memory of 2612	2300	cmd.exe	29
PID 2612 wrote to memory of 2648	2612	rundll32.exe	30
PID 2612 wrote to memory of 2648	2612	rundll32.exe	30
PID 2612 wrote to memory of 2648	2612	rundll32.exe	30
PID 2612 wrote to memory of 2648	2612	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Netti-Nuker-main\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Netti-Nuker-main\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Netti-Nuker-main\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2e16d251a6c42ec123ae4bd3065bc91a

SHA1
d0ec896f6d97042a11395901419ee47e9cbb8174

SHA256
6e7d13ed1bfb89f86998f09e42b3fdf17079d73e6a50a264a781678f5b4ccee1

SHA512
b0654beadd6d16293c83b82fcb8403c79b57cdd6a20b34c82ba16573a608bc4986330b847577e5a57f02c862551705aeb4676af1515f937d33dcf4e80a9a22fa

Download Submit