ed1e10ee0cd794b7d253741f0893c094f11a0b03c15b62451ba17dcbb84a00a4

Resubmissions

12/10/2024, 12:46

241012-pzt4ba1dmf 3

12/10/2024, 12:45

12/10/2024, 12:44

12/10/2024, 12:42

05/08/2024, 23:13

08/07/2024, 16:42

07/07/2024, 23:47

Analysis

max time kernel
1558s
max time network
1560s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REGFuck-master/RegFuck/Form1.Designer.cs
Size

6KB
MD5

1f7411a9e8697b870cbb12ce53dc1033
SHA1

bcbc0ff8850baacd6d13fbc11f8500749dea8ad2
SHA256

1b3e34c82a3a08a8ee6b6b2fefc5e707515b15e739996ba9cdae780386bdb706
SHA512

0e7398a9604ddfe8e12d1381e497b1e0d0685772f79f7a1749bc02fd534af54db867ad3f1f72691064d8fde9d6916971e46a2772a867b72d479cb42eb5a959f1
SSDEEP

192:hwlZpSiVpwrLvY47VglY4unOcC9z+S6Y49l8mHy4c7OoCXb4BP7n:hwDESpwrLvY47VWY4unxC9z+FY49lnH6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2648	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2648	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2648	AcroRd32.exe
2648	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2648	1056	cmd.exe	31
PID 1056 wrote to memory of 2648	1056	cmd.exe	31
PID 1056 wrote to memory of 2648	1056	cmd.exe	31
PID 1056 wrote to memory of 2648	1056	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\REGFuck-master\RegFuck\Form1.Designer.cs
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\REGFuck-master\RegFuck\Form1.Designer.cs"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
236a6c7fac0780e8da3b36c5d4fb3a88

SHA1
a3c88da190de0200f5125dbde749ee83f3255ecf

SHA256
187e4d5fe3edc705bcc6b2ba445139ab659cee8be726ffc008fff0be22325c82

SHA512
c582c53a4474453cb7f4d775c2e35f302f7ff00edd7b1d904c2346894bb69a997839243e940821e553ccf384c19eb240ab2360d5e0242370cd5613092587627d

Download Submit