422d9d1e5a4b6da1fcd9fe2ef2906830a8c0e026405d1876d351e881aac7c2fa

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kiwi-X-External-Kiwi-X/Default.cfg
Size

257B
MD5

feb5bc5a9216c55659a8cb3c144eb46d
SHA1

36b4333ca73104623c0c763a0f3d013de3a239b8
SHA256

954d4eaa4bf3d20a80eb60505e6ef3f502de7293ea719da86857a18a7a882ffd
SHA512

5df5a454b3e10e8072adb8813f4c6fc22c738b7fffc81374c541b8dc4f7f5e651cbfa2003b1be045c2b2fe66030885c2a564f575e238ce296aba355dc4f60563

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\cfg_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.cfg	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.cfg\ = "cfg_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\cfg_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\cfg_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\cfg_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\cfg_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\cfg_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2724	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2724	AcroRd32.exe
2724	AcroRd32.exe
2724	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2756	2104	cmd.exe	29
PID 2104 wrote to memory of 2756	2104	cmd.exe	29
PID 2104 wrote to memory of 2756	2104	cmd.exe	29
PID 2756 wrote to memory of 2724	2756	rundll32.exe	30
PID 2756 wrote to memory of 2724	2756	rundll32.exe	30
PID 2756 wrote to memory of 2724	2756	rundll32.exe	30
PID 2756 wrote to memory of 2724	2756	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Kiwi-X-External-Kiwi-X\Default.cfg
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Kiwi-X-External-Kiwi-X\Default.cfg
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Kiwi-X-External-Kiwi-X\Default.cfg"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bc2d4c69e58f208330d7e0deec744738

SHA1
0c04637d5b19807b34f8fd2b247958151b6361cb

SHA256
1d117ad76f0e8c1f755f0f32ac0241c0d989bfee31cab65b3679b6767ebf9cbc

SHA512
15ab4de9f5f2f350debf192e6187c36a93f88bc777109e791c1140241b33580b933a4166ad33265b1e57bbbafe427a3900a07208ed6f804e50d951b652613769

Download Submit