ed1e10ee0cd794b7d253741f0893c094f11a0b03c15b62451ba17dcbb84a00a4

Resubmissions

12/10/2024, 12:46

241012-pzt4ba1dmf 3

12/10/2024, 12:45

12/10/2024, 12:44

12/10/2024, 12:42

05/08/2024, 23:13

08/07/2024, 16:42

07/07/2024, 23:47

Analysis

max time kernel
1436s
max time network
1439s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REGFuck-master/RegFuck/Form3.Designer.cs
Size

2KB
MD5

33351d3df8adc4ec81a8ef762b63f6da
SHA1

117b76599a6130cc84e015dc832e3c68fcc565e5
SHA256

0b1acf1fe48b6309cc99f2f5cdd997c80f9aec72f76c0e4fc94f8473368141b7
SHA512

28bd18a53b53dd657919add76b7c40735aedf81f72edd803de1c3a4f3a6f95ffc8900af84fbda93d2d3402f4969486471dd6e250f772682847e818c023f5f40e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2392	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2392	AcroRd32.exe
2392	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2392	2748	cmd.exe	31
PID 2748 wrote to memory of 2392	2748	cmd.exe	31
PID 2748 wrote to memory of 2392	2748	cmd.exe	31
PID 2748 wrote to memory of 2392	2748	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\REGFuck-master\RegFuck\Form3.Designer.cs
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\REGFuck-master\RegFuck\Form3.Designer.cs"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
34091e52be2ae01cdb0f5c5b45342a69

SHA1
f1196d7533e6c9d968d5cc8591c89b9a95d8a40e

SHA256
0256df08b4e446e44869bb6afaa9c196136f1b7fe29d7ce604e91cdee9bd33e9

SHA512
07281947a7361af1bc17a3bc9e30703f6d2a384c30113d0e4ac428440e3be0005dbdead273290220f5ce70b3d33c6cfe2c4e22578f5b423bb0ba1bacba26b058

Download Submit