ace56fea4b7af878e92fa3caa903c1dd21e0b3b43c96ba114e682afa1c2413ed

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:18

Target

Blank-Grabber-main/Blank Grabber/env/pyvenv.cfg
Size

352B
MD5

ec0d5904fa80fff763302201a5fa3b67
SHA1

b864792c2aea2bf3e9c62bb6546fbee3b50a2b7b
SHA256

e5d6e27e5a050e960d3f7adb56a7de4458d448c858ef0a9843315fd3a0c15279
SHA512

46e7fa0a42e53db96cf277703e9df47b406987ea94b298d9ae1c5cb4511c8f462a19746e77393a0ed196ca2a1864212e137343bfb8521ea41b686f4de6270956

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\cfg_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.cfg	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\cfg_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\cfg_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\cfg_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\cfg_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.cfg\ = "cfg_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\cfg_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2660 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2660 AcroRd32.exe
2660 AcroRd32.exe

pid	process
2660	AcroRd32.exe

pid	process
2660	AcroRd32.exe
2660	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2428 wrote to memory of 2040	2428	cmd.exe	rundll32.exe
PID 2428 wrote to memory of 2040	2428	cmd.exe	rundll32.exe
PID 2428 wrote to memory of 2040	2428	cmd.exe	rundll32.exe
PID 2040 wrote to memory of 2660	2040	rundll32.exe	AcroRd32.exe
PID 2040 wrote to memory of 2660	2040	rundll32.exe	AcroRd32.exe
PID 2040 wrote to memory of 2660	2040	rundll32.exe	AcroRd32.exe
PID 2040 wrote to memory of 2660	2040	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\env\pyvenv.cfg"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\env\pyvenv.cfg
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\env\pyvenv.cfg"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2660

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
78e0499405126ac2116b80720aa481bc

SHA1
c14f8b218917ce4c09c169bc4d013ff624193f36

SHA256
ff692fe61299119ff1e5d02627c89e821ea06f95df5295ce73aca98137b0b794

SHA512
f12efaaba1da42cac97dbc83dbdc0cdbaca007b1ccb943c6d8bbf4181229984a7ee569bf71c390b46173fc20afa5c719802192724ac54a0c338ff95573638685

Download Submit