ce9b0261f301c8707b62757aad7e06ee43065bb01d7095a42a74c22a3e174ee6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

upload_758bdc1bebececccf3c29b703988d82d.sh
Size

7KB
MD5

6907e8c667ec10e1ce6bd7fa0ceb3723
SHA1

5c25decc4b16d7d7a0f59d847c9950f9f0d137c3
SHA256

ce9b0261f301c8707b62757aad7e06ee43065bb01d7095a42a74c22a3e174ee6
SHA512

f68e76833e242a48b8037b23b392f235d22369735729f46c53accb8d75db30b1bc366727f61ad08de9313342c2583e3a47f5af15c49df88c07ccc1b486a7efa7
SSDEEP

192:GpjRz8Tt+f/cG/XwojkLrSDVARASGalOHeGY:wj58of/cG/BjQmDW6Sum

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.sh	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2708	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2708	AcroRd32.exe
2708	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2700	2204	cmd.exe	29
PID 2204 wrote to memory of 2700	2204	cmd.exe	29
PID 2204 wrote to memory of 2700	2204	cmd.exe	29
PID 2700 wrote to memory of 2708	2700	rundll32.exe	30
PID 2700 wrote to memory of 2708	2700	rundll32.exe	30
PID 2700 wrote to memory of 2708	2700	rundll32.exe	30
PID 2700 wrote to memory of 2708	2700	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\upload_758bdc1bebececccf3c29b703988d82d.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\upload_758bdc1bebececccf3c29b703988d82d.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\upload_758bdc1bebececccf3c29b703988d82d.sh"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
255a285359f84d926a29a0123fe47a66

SHA1
617e8420b8c7684d5dd04b35858e2921c39b76e7

SHA256
acc273210ce374b42397f09703f7259f72bcec8aa0991afafaf5d9a46f7886dd

SHA512
176d153ba0166180ea8a5f2cc3af324d54378cdab891533aecf70bff8a7ffd438b4393bd5453518e2edfc7f9b7be1c7fee1637e555ec2fd4517f6b5507ce6408

Download Submit