Overview
overview
3Static
static
1CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...oit.py
windows7-x64
3CVE-2023-3...pt.bat
windows7-x64
1Analysis
-
max time kernel
18s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 08:58
Static task
static1
Behavioral task
behavioral1
Sample
CVE-2023-38831/.git/hooks/applypatch-msg.sample
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
CVE-2023-38831/.git/hooks/commit-msg.sample
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
CVE-2023-38831/.git/hooks/fsmonitor-watchman.sample
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
CVE-2023-38831/.git/hooks/post-update.sample
Resource
win7-20240220-en
Behavioral task
behavioral5
Sample
CVE-2023-38831/.git/hooks/pre-applypatch.sample
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
CVE-2023-38831/.git/hooks/pre-commit.sample
Resource
win7-20240221-en
Behavioral task
behavioral7
Sample
CVE-2023-38831/.git/hooks/pre-merge-commit.sample
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
CVE-2023-38831/.git/hooks/pre-push.sample
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
CVE-2023-38831/.git/hooks/pre-rebase.sample
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
CVE-2023-38831/.git/hooks/pre-receive.sample
Resource
win7-20240215-en
Behavioral task
behavioral11
Sample
CVE-2023-38831/.git/hooks/prepare-commit-msg.sample
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
CVE-2023-38831/.git/hooks/push-to-checkout.sample
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
CVE-2023-38831/.git/hooks/update.sample
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
CVE-2023-38831/exploit.py
Resource
win7-20231129-en
Behavioral task
behavioral15
Sample
CVE-2023-38831/script.bat
Resource
win7-20240220-en
General
-
Target
CVE-2023-38831/.git/hooks/fsmonitor-watchman.sample
-
Size
4KB
-
MD5
a0b2633a2c8e97501610bd3f73da66fc
-
SHA1
0ec0ec9ac11111433d17ea79e0ae8cec650dcfa4
-
SHA256
e0549964e93897b519bd8e333c037e51fff0f88ba13e086a331592bf801fa1d0
-
SHA512
5168643c1768ec83554a9066754507a781b6d14251a46a469222d462efc6ca87a72c90679154e8a723349c91e7772b32ac9b08dfe313cded0ee0a6f17885079e
-
SSDEEP
96:GFCscBOvOFXDgRvi/3UCwN4ZlkRo/j5SpoNOBoi+geBIzCa:GFCsEOmWRa8CwN4ZqRo7geEk3IzCa
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\sample_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\sample_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\sample_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\sample_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.sample\ = "sample_auto_file" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\sample_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.sample rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\sample_auto_file\shell\Read rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2540 AcroRd32.exe 2540 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1752 wrote to memory of 2736 1752 cmd.exe rundll32.exe PID 1752 wrote to memory of 2736 1752 cmd.exe rundll32.exe PID 1752 wrote to memory of 2736 1752 cmd.exe rundll32.exe PID 2736 wrote to memory of 2540 2736 rundll32.exe AcroRd32.exe PID 2736 wrote to memory of 2540 2736 rundll32.exe AcroRd32.exe PID 2736 wrote to memory of 2540 2736 rundll32.exe AcroRd32.exe PID 2736 wrote to memory of 2540 2736 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\CVE-2023-38831\.git\hooks\fsmonitor-watchman.sample1⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CVE-2023-38831\.git\hooks\fsmonitor-watchman.sample2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CVE-2023-38831\.git\hooks\fsmonitor-watchman.sample"3⤵
- Suspicious use of SetWindowsHookEx
PID:2540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5caf109909bd3fbd309290c708c8fcc25
SHA1a67c6964c293c314b28acc41691268d428295a3c
SHA256e0b708616a523a0140a8db9dfd3b0538f90c7c9b00ec74357f60bb66a4a7ad45
SHA512f99da11073d8fa931c3d1a5afba25df36ae25b3a87991fec7b496d58a04adee0d03b9bfc777a7ef195dc6463cccac6e07de86cd760fdcd58b9272846ad2abd1f