d0b4544ae0432e9228bae9cfdba3cb8271305303053b7d85940ddc52f0256605

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eclipse.lol rewrite/compiled/configs/default.cfg
Size 395B
Sample240608-ttetnaeb36
SHA256 341447c11a00ed8dc966d1435d6f4511c1438778598d3e37259a3c3282571986
MD5 c84b2dd767f890138a6e9110edc85c2b
SHA1 6a5b7cc4a87624d09477046edfe1ab0d2413791b
SHA512 602147b7f3240a5e5284123cb16f556da51695e65c0515ae72f37e063ff7b8e410db0799e81f3f33cc5ae875a93268e0f668f21509309ba7d881197bfac29ca8
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cfg_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cfg_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.cfg	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.cfg\ = "cfg_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cfg_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cfg_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cfg_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cfg_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2120	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2120	AcroRd32.exe
2120	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2552	2300	cmd.exe	29
PID 2300 wrote to memory of 2552	2300	cmd.exe	29
PID 2300 wrote to memory of 2552	2300	cmd.exe	29
PID 2552 wrote to memory of 2120	2552	rundll32.exe	30
PID 2552 wrote to memory of 2120	2552	rundll32.exe	30
PID 2552 wrote to memory of 2120	2552	rundll32.exe	30
PID 2552 wrote to memory of 2120	2552	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\eclipse.lol rewrite\compiled\configs\default.cfg"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\eclipse.lol rewrite\compiled\configs\default.cfg
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eclipse.lol rewrite\compiled\configs\default.cfg"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 1e3d48b011597e811021128863c1815a0e2a508660b80b086bf727ae2cd8c29b
MD5 1c21635c1cf5f4e49383320aed9dc866
SHA1 93b93a67f874677e4a461c9f1c4dba60bd8e9421
SHA512 4f69972bb9fc8dba3a9356829bc02290ac20f8d37281a7f75562349b983b92aaad13955dce3c0db3d0eb7d216f7685e043240d1f253400f511ee0dfd2c628c14
MD5 SHA1 SHA512

Submit Download