918ed3b8be9bc0bb3ffe5014066f5bb0fa0a0139c5ffff10559ac783aebff883

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ProjectRencifyPhasmo-main/UnityTester/ProjectRencifyPhasmo.csproj
Size

8KB
MD5

d8c9b1f20aa73e72eb4be8ba31b59dc5
SHA1

1fb1bdaa23411fd4a682663d61d1a06269365c04
SHA256

acf4446b853910e69477c238e98655491f1987fe29bbd40c374199b43db62927
SHA512

966932812591904da4d3cfa603650fdeefdd4cf2422770ed5a4230d4f3b7d679967d4249846ac3075b5e6b35a8990b1523995732b98a7871c5f1c3ac8b1443ae
SSDEEP

96:7YWnpu5fghoZhKzcfhKz7xia4iBuxp2uxpY4uxpWuxpWnWbhFEXWpTUSVuE5vmAY:7WIiZoQx9INYWbJlHeyuTYtn54

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2516	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2516	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2516	AcroRd32.exe
2516	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2516	2480	cmd.exe	29
PID 2480 wrote to memory of 2516	2480	cmd.exe	29
PID 2480 wrote to memory of 2516	2480	cmd.exe	29
PID 2480 wrote to memory of 2516	2480	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ProjectRencifyPhasmo-main\UnityTester\ProjectRencifyPhasmo.csproj
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ProjectRencifyPhasmo-main\UnityTester\ProjectRencifyPhasmo.csproj"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3ba8150a06bff66dd3ae885b9410e171

SHA1
2027d34ee6bbab3c9a58bb9efdcce6a07fe05d95

SHA256
d7b8bef14ffa4b80e790ec18328cbee76c4117eb4f50d4750ba678be0303f344

SHA512
87e5104a4879c064cf7845aea7392814347826348bcd240716cc9018fbc0a5c5ce32e40a35859d9134d8649ac26d23fa3b2cca7a92b29524a6fc637f031980b6

Download Submit