422d9d1e5a4b6da1fcd9fe2ef2906830a8c0e026405d1876d351e881aac7c2fa

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kiwi-X-External-Kiwi-X/README.md
Size

63B
MD5

3931791afb71ca333983bfaa5e1ccb90
SHA1

7b36519c2ce47c9bfd46082427bd6ea87d722205
SHA256

fa1a75d95b3b80c4d71dd46da63ad3cb605e7eddd388b5a3ce12603de103e7c9
SHA512

352aff6f070ebad299db5026fdb0cb4ba99146867615a7c61c33532b5563003d8d2081a9db1b7c59d5b2296d03511cf983987c2b764c750d106ec842196e23e0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\md_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2496	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2496	AcroRd32.exe
2496	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2612	1712	cmd.exe	29
PID 1712 wrote to memory of 2612	1712	cmd.exe	29
PID 1712 wrote to memory of 2612	1712	cmd.exe	29
PID 2612 wrote to memory of 2496	2612	rundll32.exe	30
PID 2612 wrote to memory of 2496	2612	rundll32.exe	30
PID 2612 wrote to memory of 2496	2612	rundll32.exe	30
PID 2612 wrote to memory of 2496	2612	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Kiwi-X-External-Kiwi-X\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Kiwi-X-External-Kiwi-X\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Kiwi-X-External-Kiwi-X\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c3183979122b9fe9852059cfc462854c

SHA1
5b0b712511a79ae527289714dde5333bd51e2044

SHA256
14b95f408a40eb0405d0c3e9913deb658ba350cc337ab427477c62aa5761439a

SHA512
4bf114c44054a484556265de02a8080bd751fa2d9963775da34d17dfaa603edb3ce6f46425aa5982a9a6c9b0fdb091843604fae527e16160ca9e95bf7eaadcd6

Download Submit