624885e9af700160ed9ee16599324c0fe7e83525646cd08d1233fe81f273e822

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

apagar.sh
Size

123B
MD5

8f477cc295e8f15ea21193c7a46969e4
SHA1

e2022917f0bebec8c614b04edd689cabffee3cfc
SHA256

624885e9af700160ed9ee16599324c0fe7e83525646cd08d1233fe81f273e822
SHA512

56e1248cf8766557aa39102e62abfabba4c20068386966fcfe9500367b816308067faa2102bb07246df6ead55a6a47c1ecd142f95b5931fe31d24f676b7b94da

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\sh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.sh	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\sh_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\sh_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2412	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2412	AcroRd32.exe
2412	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2508	3044	cmd.exe	29
PID 3044 wrote to memory of 2508	3044	cmd.exe	29
PID 3044 wrote to memory of 2508	3044	cmd.exe	29
PID 2508 wrote to memory of 2412	2508	rundll32.exe	30
PID 2508 wrote to memory of 2412	2508	rundll32.exe	30
PID 2508 wrote to memory of 2412	2508	rundll32.exe	30
PID 2508 wrote to memory of 2412	2508	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\apagar.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\apagar.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\apagar.sh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
eaf8fd337b48d369e0b4597f11ffac69

SHA1
c7ce581ed83558c89a3441cd963c5a1c96f4c740

SHA256
296ea78d90cae56df7b1525dfe69f1ad4964d1a2c075f6f72d6069ab3daab002

SHA512
ca634c37f493aeda9634bd5f5314fb74c16203404eac5032e68545d5ade37d0aaad3f072ee93658d94e5a3c0b7b832f833fac06d15de1e724e00eca0c8cc8505

Download Submit