918ed3b8be9bc0bb3ffe5014066f5bb0fa0a0139c5ffff10559ac783aebff883

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ProjectRencifyPhasmo-main/UnityTester/Program.cs
Size

534B
MD5

43bd5aad31f2212a20f5ba6a258db3d2
SHA1

e9f3b3d2a7d44b3e9d4be627f69bf57f3be0015a
SHA256

a0a7ad76433958d538e8b2d1f89dfcf0f5d860c387aca436b840d77edaca0ee7
SHA512

2606435007d66c419756ffd6e7d83c48faa51d415fadcbbe49d0cb8de507c8907972f857f51cd54e8b959c4e4f0754c3e2afaad788fb96f93ecf74efc9557b58

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2460	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2460	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2460	AcroRd32.exe
2460	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2460	2340	cmd.exe	29
PID 2340 wrote to memory of 2460	2340	cmd.exe	29
PID 2340 wrote to memory of 2460	2340	cmd.exe	29
PID 2340 wrote to memory of 2460	2340	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ProjectRencifyPhasmo-main\UnityTester\Program.cs
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ProjectRencifyPhasmo-main\UnityTester\Program.cs"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8297107ad87a35c6e5c9a37b114d6960

SHA1
530c5e794ee3e69b1144c3fc8d0e0a812e7d125d

SHA256
66a6c5c291d11f3c3b6039aeefca605a0c62ae4cebab1322cdc42073f88b4f3c

SHA512
8dd054503695b58ce376efd0037fad90f97d362a29719e777e8582da27a0c8c72e4acd52743da7f8e38ff6a13239e47103a4be870bff93930b6b225b61baa457

Download Submit