Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
find.sh
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
find.sh
Resource
win10v2004-20240508-en
General
-
Target
find.sh
-
Size
58B
-
MD5
9d1100ea782e400837113ca04b67f43c
-
SHA1
60d07b193f18237135f62e3fb5aeb5b646350524
-
SHA256
b3363f666c6339fa6bb0ed190f553a802d75baf81098a35ff9044f115ec76d5e
-
SHA512
4ab6f1a30a3b8cff844f9f61bf1f7e5dcf7dd181e46d2e2ac61db9f86d4d37fa2ca3bd537fac3e0e25b5b198ff0c776342b351216ff390c53c65770e7ea498da
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.sh rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.sh\ = "sh_auto_file" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2632 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2632 AcroRd32.exe 2632 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1304 wrote to memory of 2616 1304 cmd.exe 29 PID 1304 wrote to memory of 2616 1304 cmd.exe 29 PID 1304 wrote to memory of 2616 1304 cmd.exe 29 PID 2616 wrote to memory of 2632 2616 rundll32.exe 30 PID 2616 wrote to memory of 2632 2616 rundll32.exe 30 PID 2616 wrote to memory of 2632 2616 rundll32.exe 30 PID 2616 wrote to memory of 2632 2616 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\find.sh1⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\find.sh2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\find.sh"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2632
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD55257353995b434d72d738ac53844de4d
SHA1129d21f640f6921d7ea86d1c2808788b8130f294
SHA256c756387e0a80202c4297cbe78fb4d4afc537a939c5af3de8be6abeebe3c1b51f
SHA512c5c8b5e65d13032b44e4e49f3e3503dfb3ee8d0fff60d371c3ff71c9a1a2f247995d553709d5c8809cc9dbebc1e05712fccab3168ec22db3e1700fa826856963