a693fff41c4e738cfa6b7f0e9bcf51ae341b276b81189fa698f0c0ede4a8a54e

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kiwi X/Kiwi X.exe.config
Size 1KB
Sample240515-chm78acf43
SHA256 97ca967656db09e3d7046339e5c9e774c179a8d9d7bc72584eb5a8071871c2ec
MD5 1f48b296eae19f30d6abdd9e1fbc1a14
SHA1 8529346e5c926a9f4ded49320873f70ec6a7f9d0
SHA512 c69e5e0b82a27596bc5e2481d580fdd5588036eec6fc13de31e1dfdfe9a6b81882a69c43a3f3f2f145cf17a55cfb2ce4cd28c21291935fa13336a379f040a7ee
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2488	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2488	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2488	AcroRd32.exe
2488	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2488	1084	cmd.exe	29
PID 1084 wrote to memory of 2488	1084	cmd.exe	29
PID 1084 wrote to memory of 2488	1084	cmd.exe	29
PID 1084 wrote to memory of 2488	1084	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Kiwi X\Kiwi X.exe.config"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Kiwi X\Kiwi X.exe.config"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 afe715b9a861f681737fc389c1ceeabea5809020069a118ebca5dc73a39d354a
MD5 dfafc997a5acabbd4647e9857b37fcd3
SHA1 e26e9b6d29097a7cdc3b5bf8bd994677822566a9
SHA512 0586894a10839d6950102cd38cd05679aedb2df9f48681b5435fde975fbb08aaefaff062a9b06107f9c7c133178bc724412ca9529ebf1f74a47c1883a58c81fb
MD5 SHA1 SHA512

Submit Download