ed1e10ee0cd794b7d253741f0893c094f11a0b03c15b62451ba17dcbb84a00a4

Resubmissions

12/10/2024, 12:46

241012-pzt4ba1dmf 3

12/10/2024, 12:45

12/10/2024, 12:44

12/10/2024, 12:42

05/08/2024, 23:13

08/07/2024, 16:42

07/07/2024, 23:47

Analysis

max time kernel
1562s
max time network
1568s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REGFuck-master/RegFuck/Program.cs
Size

915B
MD5

037c8023b8f74b28267e3c7d5bc936a6
SHA1

026572bc4e84339288d678f4eeb362148b86153c
SHA256

e37ad9974e0dc9e67790cb88cd3b5f236bedaff9d5c68b44882ccb3acebd36ff
SHA512

1c19126cc1b85beeaefbd4510133b121f016936b7fdbb83b243fb4ad86c63e81ae87927e2302b5933d6708f6f9ca8c497de7e29890e2790e810e08077e17ceaa

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1652	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1652	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1652	AcroRd32.exe
1652	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 1652	2716	cmd.exe	31
PID 2716 wrote to memory of 1652	2716	cmd.exe	31
PID 2716 wrote to memory of 1652	2716	cmd.exe	31
PID 2716 wrote to memory of 1652	2716	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\REGFuck-master\RegFuck\Program.cs
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\REGFuck-master\RegFuck\Program.cs"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c0fa15fada67fc163a45301f87e1ba61

SHA1
b5021a414e5da29daaa60d6a6e071ab3518b4f9c

SHA256
2c784b2894add639dd4effeb6f378bed534afcd47f5dabedd65ba540c8aabb5f

SHA512
52b80fe23e7b608954e7ebf019eb68ffa43258cb1017edba56a6fbf172c7312cd7cbdc5f9a9c59559305b463ffccd0d55037262cfbeb24aad23d19c0f3290935

Download Submit