918ed3b8be9bc0bb3ffe5014066f5bb0fa0a0139c5ffff10559ac783aebff883

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ProjectRencifyPhasmo-main/UnityTester/Form1.Designer.cs
Size

238KB
MD5

4099543b2eacd8679a6d4d0f71b573fb
SHA1

68a43452fc2f43b1017d5532603a70e510f5ad3d
SHA256

a00bbb67f45739f7fa29c43ba93af87d0471b26a2fb328b5f90a9783e507d057
SHA512

4843ced5f1114b5f6d5a4b66876a6f482d80527dbb7d67cfdcc8f6cc4fe446558d0ae71a5b9ea80a1099eb36afbc2ac6b5adc19749bedf2d6abf7db27a0661ed
SSDEEP

1536:iGIU4nV9KoXkpnXDLKE9s7C7mTBTXmQLLdHl6i6UXo8MlCBgdQBu/WfV/FCf75sH:yOaIQvrMQnwSyPMEimH2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2480	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2480	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2480	AcroRd32.exe
2480	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2480	2848	cmd.exe	29
PID 2848 wrote to memory of 2480	2848	cmd.exe	29
PID 2848 wrote to memory of 2480	2848	cmd.exe	29
PID 2848 wrote to memory of 2480	2848	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ProjectRencifyPhasmo-main\UnityTester\Form1.Designer.cs
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ProjectRencifyPhasmo-main\UnityTester\Form1.Designer.cs"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
015a1c18a1aaed1ae4fdc186cdd77932

SHA1
8724f2a14185703cf42638c1cf4669909887c05e

SHA256
7a4d321e02ef4b5bfd2f3d9f40611744b26def73e3072d294e6d725b1b033c60

SHA512
981e6d59c556335d834e70726876dc3abeda54ee5638286ae96019e96d4cc3812f4ceddc91a2922bca9bbf561895291ec54e4305384d8f11fa5a941113070aa8

Download Submit