918ed3b8be9bc0bb3ffe5014066f5bb0fa0a0139c5ffff10559ac783aebff883

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ProjectRencifyPhasmo-main/UnityTester/Properties/AssemblyInfo.cs
Size

1KB
MD5

959e1bc40742d4b35eb05eea89ac5c12
SHA1

2fca855edf153dadf7a32a92afb37fcb00dc4f1f
SHA256

71e8f87e7921a70209842f9f94865cd7302ee1d020465741795b8988f6fdf009
SHA512

b4c24b29cd3b57a88203979865e33b8f0932558e35c1bd3e3069f564b26d855a235afef4978b0ebd034657b6cb48b3723296b0c53c9be6c2005859d6b859ef5f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2936	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2936	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2936	AcroRd32.exe
2936	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2936	2084	cmd.exe	29
PID 2084 wrote to memory of 2936	2084	cmd.exe	29
PID 2084 wrote to memory of 2936	2084	cmd.exe	29
PID 2084 wrote to memory of 2936	2084	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ProjectRencifyPhasmo-main\UnityTester\Properties\AssemblyInfo.cs
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ProjectRencifyPhasmo-main\UnityTester\Properties\AssemblyInfo.cs"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d060593d791ceae4963ca707db1dfe05

SHA1
4807704fa6aab8e9d44344bb29cf28814c09adfe

SHA256
b29668000a4214313cb6fc670cc04e323086d87a1723197e0127957d8209a177

SHA512
fc64de74aa41019d6de31dba2e5549cd05ce0db02b65bbc6d525864e8df27161a5b7554dad147b1af76ec4849746513c91cea1a7e990b071f329d6a2bfb69e55

Download Submit