fd0544bdeb691b88a388b2a51da072c4de37b5f7d9af2a1948d45aed755a80a2

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
README.md
Size 1KB
Sample240608-tl7jpsea65
SHA256 032f9da262b974acb90aaa89202788ea9a7bda47bfd86137f559976cd802773e
MD5 79d5c8aba08210134bb7eb9e1cf74791
SHA1 6e6aad0f6ebe8b14a63e1b248b2ff018c92331bf
SHA512 e50de436d90540a50eefc75fc4d120236736ca6352280522c7743b883dc2e3f97eb8116018eda922e81d3f30cc1626fb989bfdab15ae2c5bb57efccf7f08e32b
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.md	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2704	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2704	AcroRd32.exe
2704	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2776	2356	cmd.exe	29
PID 2356 wrote to memory of 2776	2356	cmd.exe	29
PID 2356 wrote to memory of 2776	2356	cmd.exe	29
PID 2776 wrote to memory of 2704	2776	rundll32.exe	30
PID 2776 wrote to memory of 2704	2776	rundll32.exe	30
PID 2776 wrote to memory of 2704	2776	rundll32.exe	30
PID 2776 wrote to memory of 2704	2776	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 e6a0bcdfe434ed34449594b1c27462f85f936ac44557525b09fac8c34e341069
MD5 01d8ab78dd4a5ffa42cbd8e240340c7f
SHA1 0d8682b58d5fa817d4d1f6c9cb35d8573051e6f1
SHA512 3493e1c07b3da10e386257e64c26f4dfbbfb0bd128fd94ef51430e8e8129b503f5f97ee4cd64bb44723df6c7175b6e61aae30d7aa05c3e1b6465a20114a2f18a
MD5 SHA1 SHA512

Submit Download