Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 11:40
Static task
static1
Behavioral task
behavioral1
Sample
upload_758bdc1bebececccf3c29b703988d82d.sh
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
upload_758bdc1bebececccf3c29b703988d82d.sh
Resource
win10v2004-20240426-en
General
-
Target
upload_758bdc1bebececccf3c29b703988d82d.sh
-
Size
7KB
-
MD5
6907e8c667ec10e1ce6bd7fa0ceb3723
-
SHA1
5c25decc4b16d7d7a0f59d847c9950f9f0d137c3
-
SHA256
ce9b0261f301c8707b62757aad7e06ee43065bb01d7095a42a74c22a3e174ee6
-
SHA512
f68e76833e242a48b8037b23b392f235d22369735729f46c53accb8d75db30b1bc366727f61ad08de9313342c2583e3a47f5af15c49df88c07ccc1b486a7efa7
-
SSDEEP
192:GpjRz8Tt+f/cG/XwojkLrSDVARASGalOHeGY:wj58of/cG/BjQmDW6Sum
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.sh rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.sh\ = "sh_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2708 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2708 AcroRd32.exe 2708 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2700 2204 cmd.exe 29 PID 2204 wrote to memory of 2700 2204 cmd.exe 29 PID 2204 wrote to memory of 2700 2204 cmd.exe 29 PID 2700 wrote to memory of 2708 2700 rundll32.exe 30 PID 2700 wrote to memory of 2708 2700 rundll32.exe 30 PID 2700 wrote to memory of 2708 2700 rundll32.exe 30 PID 2700 wrote to memory of 2708 2700 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\upload_758bdc1bebececccf3c29b703988d82d.sh1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\upload_758bdc1bebececccf3c29b703988d82d.sh2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\upload_758bdc1bebececccf3c29b703988d82d.sh"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2708
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5255a285359f84d926a29a0123fe47a66
SHA1617e8420b8c7684d5dd04b35858e2921c39b76e7
SHA256acc273210ce374b42397f09703f7259f72bcec8aa0991afafaf5d9a46f7886dd
SHA512176d153ba0166180ea8a5f2cc3af324d54378cdab891533aecf70bff8a7ffd438b4393bd5453518e2edfc7f9b7be1c7fee1637e555ec2fd4517f6b5507ce6408