33461d788a33b88bed3d489826f9fb766cae421f322b81c5eb861718a1dea7bb

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RoBrute-master/proxy.yaml
Size

103B
MD5

232b7ad6ace65f83f66c840d8bed9ab1
SHA1

f94b2b8970f26ea9678fcfaa73abf606e6848052
SHA256

f1e9af216da7c7dec44e58e4af4a814f6be742ca4c8f18f0fbe06e1fbd33cc36
SHA512

68240f638da51862c556a2edfa79cbfabb071d724651341a804e14462845ad134c3a4c4bd82117dc6c00ee6525fb9bc2b25b7d2ed57a905643de63d1df0c94b9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\yaml_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\yaml_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\yaml_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\yaml_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\yaml_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.yaml	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.yaml\ = "yaml_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\yaml_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2436	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2436	AcroRd32.exe
2436	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2468	2008	cmd.exe	29
PID 2008 wrote to memory of 2468	2008	cmd.exe	29
PID 2008 wrote to memory of 2468	2008	cmd.exe	29
PID 2468 wrote to memory of 2436	2468	rundll32.exe	30
PID 2468 wrote to memory of 2436	2468	rundll32.exe	30
PID 2468 wrote to memory of 2436	2468	rundll32.exe	30
PID 2468 wrote to memory of 2436	2468	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RoBrute-master\proxy.yaml
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RoBrute-master\proxy.yaml
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RoBrute-master\proxy.yaml"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6621b51f0f16ec63179b9e8684608391

SHA1
874f6905e68b84b9343b983ce419363a61467c7f

SHA256
db3b16f4879d069a04d0c2cba33eed2d578bcf6380cc56c50d9f3ee68e19e526

SHA512
4b894abb43a83bf575f99a1527a87e8cefd36a60b45ac16d682f2dd43523d54f69c27276aec8d8fbcf58c46c1e53ae211d0ba1bef99076f30218f8177c5d9fd7

Download Submit