c3f250ab11d40bc8e68d90efa095da80a4e2c285d3d04e1c52434158345e2b47

Analysis

max time kernel
18s
max time network
16s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CVE-2023-38831/.git/hooks/pre-receive.sample
Size

544B
MD5

2ad18ec82c20af7b5926ed9cea6aeedd
SHA1

705a17d259e7896f0082fe2e9f2c0c3b127be5ac
SHA256

a4c3d2b9c7bb3fd8d1441c31bd4ee71a595d66b44fcf49ddb310252320169989
SHA512

ee08c11fab7e896b2e09c241954ba7640338b12c75cd8040daf053c31b2f22236d7a0deac736f89d305236312fdb4f560a38d4d8debdcc9dcdd23b2d975907d5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\sample_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\sample_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.sample	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.sample\ = "sample_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\sample_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\sample_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\sample_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\sample_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2748 AcroRd32.exe
2748 AcroRd32.exe

pid	process
2748	AcroRd32.exe
2748	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1740 wrote to memory of 2340	1740	cmd.exe	rundll32.exe
PID 1740 wrote to memory of 2340	1740	cmd.exe	rundll32.exe
PID 1740 wrote to memory of 2340	1740	cmd.exe	rundll32.exe
PID 2340 wrote to memory of 2748	2340	rundll32.exe	AcroRd32.exe
PID 2340 wrote to memory of 2748	2340	rundll32.exe	AcroRd32.exe
PID 2340 wrote to memory of 2748	2340	rundll32.exe	AcroRd32.exe
PID 2340 wrote to memory of 2748	2340	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CVE-2023-38831\.git\hooks\pre-receive.sample
1⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CVE-2023-38831\.git\hooks\pre-receive.sample
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2340

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CVE-2023-38831\.git\hooks\pre-receive.sample"
3⤵
- Suspicious use of SetWindowsHookEx
PID:2748

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
27d283e13030afa8a6cb362f01e1cc13

SHA1
20ae5a3fceae9b322a75c525a7c376bd65e69631

SHA256
36445edf22a313d9b6850f73e7132c31e52afe9a7cb42f421c9be21f843f297a

SHA512
ef930fbca2fce32d013e6561626fbe9f094a07319cfbf89f67ee08424c82ed4d3834e06a153c506148a32b8d09551eb0bfff1737922ac18f5c4e887f84c2dfb1

Download Submit