ed1e10ee0cd794b7d253741f0893c094f11a0b03c15b62451ba17dcbb84a00a4

Resubmissions

12/10/2024, 12:46

241012-pzt4ba1dmf 3

12/10/2024, 12:45

12/10/2024, 12:44

12/10/2024, 12:42

05/08/2024, 23:13

08/07/2024, 16:42

07/07/2024, 23:47

Analysis

max time kernel
1560s
max time network
1562s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REGFuck-master/RegFuck/RegFuck.csproj
Size

6KB
MD5

9eb811dd48b746eb0ebf66f37f9795e0
SHA1

01121353019e4dea53dce6f4f33087a00eb3a260
SHA256

a199e6e9afa1efc89252ab98716cc80a0f5308d5e04b28ac444a2f4a8de7c8fe
SHA512

0c60fdc6ae6ba1e329a8f0561347a1879b90504ce950955f868ab053fac9c8dd18f8bdc80a074a9e1197e4d42124639992c6f2879654e001a441993d2f4a9289
SSDEEP

96:wPnpqVCvvO9ha9QeBx5+0xHHNws2hvq4eKHHGW+Tcl/:lVUOX8x5Od/

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2756	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2756	AcroRd32.exe
2756	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2756	2352	cmd.exe	31
PID 2352 wrote to memory of 2756	2352	cmd.exe	31
PID 2352 wrote to memory of 2756	2352	cmd.exe	31
PID 2352 wrote to memory of 2756	2352	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\REGFuck-master\RegFuck\RegFuck.csproj
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\REGFuck-master\RegFuck\RegFuck.csproj"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3c05c03e9e97d149f3206a5f56b10dfa

SHA1
e5b5c98ea7c35b8704aa66f10ed1a692923b4413

SHA256
08613f4ed15e2bd6b446185563c15f73ec9d491b830e62ae4c5cd6e0dbfb4f4b

SHA512
1501c3248273296f31729841ceab8056c1dc58165808f6f622236f57bacbe93f521b009da20dad4b906f3dae67084fabcd3097abef10fcf8e1efd4902dfb0402

Download Submit