3bcf6dc0edc724aa0ee32813d59965085204b16a6b017a16925ff45ed2831f98

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lua-executor-by-tiago-main/README.md
Size 542B
Sample240531-plashshd56
SHA256 d596e91bbd6d21f458b9d5313972b285ae07e3583915aa1d2b21a0902c8d36c4
MD5 6374848283338fe46ce55c04c1c021ac
SHA1 5c927e6a5652c8cd3b8fa84dc6b6a490c51be903
SHA512 d105601dde6ec399e99f6bcdd622a6f052f5b7a12a96e6ec09e70fe822c963a6db9dd0027c026dd57f2d05abbc4b7f3c555c4ef8a7662f117b0260832f529a5d
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.md	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2656	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2656	AcroRd32.exe
2656	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2144	2632	cmd.exe	29
PID 2632 wrote to memory of 2144	2632	cmd.exe	29
PID 2632 wrote to memory of 2144	2632	cmd.exe	29
PID 2144 wrote to memory of 2656	2144	rundll32.exe	30
PID 2144 wrote to memory of 2656	2144	rundll32.exe	30
PID 2144 wrote to memory of 2656	2144	rundll32.exe	30
PID 2144 wrote to memory of 2656	2144	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lua-executor-by-tiago-main\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\lua-executor-by-tiago-main\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\lua-executor-by-tiago-main\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 1343af92858e732990e6ad7ce02f8905b217acac1d9de945eaed6c21e9f24650
MD5 d3730a4616c91a1247043f316efa4f43
SHA1 2d955af9a9dc62f48d6ca2897b6df30d5a09a373
SHA512 6f382e7690a1b3e438a097c8033eda9cd61bf683466ad6d5f8a104db51ad90883903b2a9b2c14885092a7ff3487aa4af3e8e1226919dc58d7b5ba4bb7fcb10cd
MD5 SHA1 SHA512

Submit Download