Overview
overview
10Static
static
1Data2.zip
windows7-x64
1Data2.zip
windows10-2004-x64
1hv.exe
windows7-x64
5hv.exe
windows10-2004-x64
10iepdf32.dll
windows7-x64
3iepdf32.dll
windows10-2004-x64
3rhombohedron.ai
windows7-x64
3rhombohedron.ai
windows10-2004-x64
3shovelnose.deb
windows7-x64
3shovelnose.deb
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 06:44
Static task
static1
Behavioral task
behavioral1
Sample
Data2.zip
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Data2.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
hv.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
hv.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
iepdf32.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
iepdf32.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
rhombohedron.ai
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
rhombohedron.ai
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
shovelnose.deb
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
shovelnose.deb
Resource
win10v2004-20240508-en
General
-
Target
shovelnose.deb
-
Size
827KB
-
MD5
90b47672d8134f8cc464d83a5cde8d34
-
SHA1
69567e6a2dd5569b8cd2876a275f5d9a2ad8743f
-
SHA256
cc38b5cb522fdf8d2fe5e85c50d72e1b8ac39d36deb157d4bffdda7970c5ba8b
-
SHA512
7dbeb8d4a5674c088fa904a9fdcddf9cb84d41b2d2c887ba38cfcdd1ac30cf4cd8ae28bc33fc3ee51139e78645f7fb580dfaf57e939c4e144b79d507a1d1d90b
-
SSDEEP
12288:WvQVCaTVXT7qj+VOdVqL5Tu/eNwZWNtexC5RAib9wxbQiDm1Yu:S+y+sVqL5TwebNRAibyxbQqu
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\deb_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.deb\ = "deb_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\deb_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\deb_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\deb_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\deb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\deb_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.deb rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2668 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2668 AcroRd32.exe 2668 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2036 wrote to memory of 2600 2036 cmd.exe rundll32.exe PID 2036 wrote to memory of 2600 2036 cmd.exe rundll32.exe PID 2036 wrote to memory of 2600 2036 cmd.exe rundll32.exe PID 2600 wrote to memory of 2668 2600 rundll32.exe AcroRd32.exe PID 2600 wrote to memory of 2668 2600 rundll32.exe AcroRd32.exe PID 2600 wrote to memory of 2668 2600 rundll32.exe AcroRd32.exe PID 2600 wrote to memory of 2668 2600 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\shovelnose.deb1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\shovelnose.deb2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\shovelnose.deb"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD53f66cd5988c9e7d7d93af9c29b38de8d
SHA1f64003637d9241593df42d0bb0b87aac7408e55c
SHA256789b8b426948a38389c41265aa143486886f6f44e3638995e581be04993891f0
SHA5120efa18a2f06623a1e37763498e2647d63ac6cc470bd3ec58c6fe7e7fb5815a130f96dd612679c5f5de88190c79424915ad6b200aaf05a42db7fd243954303ba1