18ddcf2eba0cfd5f1f79b36250afe9a8a03986c6b73cd55ae1aa412046d33756

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SolaraB/Solara/workspace/IY_FE.iy
Size

539B
MD5

254236b95c2d6ae908e93a360fb749b8
SHA1

57ed578dbd1230cce16d31ae380394f2a649325c
SHA256

6f6330ec143d653fbbfd14672a534def12ff9325e7aec90b41f65f059ad2ae26
SHA512

812b01941160c6fe41b77ad0f1ce905fb84a552ee6d0d42a4c0b0fbca018718c94ede6c081ea220a2e6e401b4ed2b23d088ce6c70417c860e3d259babc1223c3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\iy_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\iy_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.iy	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\iy_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\iy_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.iy\ = "iy_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\iy_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\iy_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2760	AcroRd32.exe
2760	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2752	2364	cmd.exe	29
PID 2364 wrote to memory of 2752	2364	cmd.exe	29
PID 2364 wrote to memory of 2752	2364	cmd.exe	29
PID 2752 wrote to memory of 2760	2752	rundll32.exe	30
PID 2752 wrote to memory of 2760	2752	rundll32.exe	30
PID 2752 wrote to memory of 2760	2752	rundll32.exe	30
PID 2752 wrote to memory of 2760	2752	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SolaraB\Solara\workspace\IY_FE.iy
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SolaraB\Solara\workspace\IY_FE.iy
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SolaraB\Solara\workspace\IY_FE.iy"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
148da29e89abf09d3557cc4e1f1eac8e

SHA1
d8c3e3726f4061af25ba271b2883af7901892af5

SHA256
2c28d829237b3cb92fa6466420b789499cad17e6235f719f662f6d285ee60281

SHA512
8a747ac06603ab4f4e1ec261a7a6c0d474a0a08092702558a738d97618d5a92b91ca244cfccd1b01357f991615fcaf4ac3e2341849ad870f338bf4e079fbc089

Download Submit