c16fb37174db73f6d6070a87c43beda40357452e1e7ca344fe457b836c9d6976

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tool-boost-funk-boost/README.md
Size

768B
MD5

1f6c0d77f3af20bed06b600044711dfb
SHA1

88fc060965073fc357cca3be3f1d585b23e4815a
SHA256

e862b7f17a2f78c22a5e7b50f6459c9c77b32e326e8e71c79144728e3be3ebe0
SHA512

8f2848e06e8de0d9fa598d0658a2f8c1f527d4aafc879cd1d65dfd0ace0d8bafcc773ea25a0c3404728e4a9b2ca90f9c77b4b41222ea66cfd2735c296ebdce18

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2548	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2548	AcroRd32.exe
2548	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3036	2368	cmd.exe	29
PID 2368 wrote to memory of 3036	2368	cmd.exe	29
PID 2368 wrote to memory of 3036	2368	cmd.exe	29
PID 3036 wrote to memory of 2548	3036	rundll32.exe	30
PID 3036 wrote to memory of 2548	3036	rundll32.exe	30
PID 3036 wrote to memory of 2548	3036	rundll32.exe	30
PID 3036 wrote to memory of 2548	3036	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tool-boost-funk-boost\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tool-boost-funk-boost\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tool-boost-funk-boost\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3720aee90503ce520a1df1759550727c

SHA1
e3f06535e778bf42a9295d1dabcbc9481236f7ce

SHA256
057cede6e6919dfb7262940aba450b20dcc19f7d6d7fe30d5012934a87b8fb42

SHA512
2d12cbf5087a32333db32d63626065fdd3b6c37d929e6e1d5b7de50f5e763ce88fa5fb7582f607719d5d18b92b7092c3e6613a3d0f552cb1732827159b12e242

Download Submit