b47f027d4abb21ce7a8eca56eea90b8df16a017ea8c8a7bac9f2aaac6b76b70b

Resubmissions

09/03/2025, 18:47

250309-xfehhsxzgw6

09/03/2025, 16:56

12/06/2024, 17:05

12/06/2024, 16:56

12/06/2024, 16:50

12/06/2024, 16:40

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sketchyorignorant-main/67175985.gz
Size 7KB
Sample240612-vft7vsscma
SHA256 4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822
MD5 882dbbc613a93f64c3709b0a2bd0d6dc
SHA1 3bd865df56c1f9266444b96351a1c30ffa5d9d75
SHA512 9d22616bfb4a75770a828a0a3cddac6787297a5fdc53eb17e25811cc94de717f2de8bd66d53c5d65ba1c83d8892aefee5ae758cf56a1ef0a0c3120f70b244339
SSDEEP 192:bjXHn5J4OIuWn3894xCwiOjT/qs8YSAFNlSyCqwvH02t:PXHn5J4OIuWnseHjGmFNtvwfjt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\gz_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\gz_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\gz_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.gz	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.gz\ = "gz_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\gz_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\gz_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\gz_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2612	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2612	AcroRd32.exe
2612	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2748	2392	cmd.exe	29
PID 2392 wrote to memory of 2748	2392	cmd.exe	29
PID 2392 wrote to memory of 2748	2392	cmd.exe	29
PID 2748 wrote to memory of 2612	2748	rundll32.exe	30
PID 2748 wrote to memory of 2612	2748	rundll32.exe	30
PID 2748 wrote to memory of 2612	2748	rundll32.exe	30
PID 2748 wrote to memory of 2612	2748	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sketchyorignorant-main\67175985.gz
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\sketchyorignorant-main\67175985.gz
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\sketchyorignorant-main\67175985.gz"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 15915cd872851cbaa61b8fc054d87ec9c979317d54df542b94f8ee681bdd6f41
MD5 8ba8d889b79ed1e203cf2e3f8b327faf
SHA1 4bc0cbeb617afa845afb4175942a6794f554c91a
SHA512 b5f1e6703727f2c9a9f82da69d1677647dfa98222b815eac043be5a4a95d3abbb6acb3a08bb38205bd2a4ae4385bfb6a34529dcda1f4df6e9b2178aa81737f6b
MD5 SHA1 SHA512

Submit Download