918ed3b8be9bc0bb3ffe5014066f5bb0fa0a0139c5ffff10559ac783aebff883

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ProjectRencifyPhasmo-main/UnityTester/Properties/Settings.Designer.cs
Size

1KB
MD5

95ad50d5df136f395f545dbc40702e2f
SHA1

5399adcf3d5dacfa81016d47154d1cb8acdfd462
SHA256

286f22ea27de8154e0ce00250cd6cc675e52891f9c5fb87138fc76fe82b04a7a
SHA512

5d87f43ec9564e28cbb75efeaa2bdf904e1288541d2f13f9f5a531db53f894315f35a8c01fa9ec3cb8351e47849c2fd8718202b797d2c662376ef2701118d28a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2480	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2480	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2480	AcroRd32.exe
2480	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2480	2076	cmd.exe	29
PID 2076 wrote to memory of 2480	2076	cmd.exe	29
PID 2076 wrote to memory of 2480	2076	cmd.exe	29
PID 2076 wrote to memory of 2480	2076	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ProjectRencifyPhasmo-main\UnityTester\Properties\Settings.Designer.cs
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ProjectRencifyPhasmo-main\UnityTester\Properties\Settings.Designer.cs"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
731d634461f47a58b0dc7b576c596202

SHA1
ef896505ac1d02aecd8b8e9f2017540d22c61f25

SHA256
e871b2d7eb1c452c0eb71cb4e1cceaa1b85233ddcae3c33fec89481eafd09302

SHA512
d32d4f456b8c4bfa8fcae2d0003f60b5e22adad5e8fd9099add30691feae01c3579af042ab9c6a54b267825499e55918058487eaf4ce1ff23c958db457ac9349

Download Submit