9007329eaf532e2138a845d50881748a6896f73a7a814127f38213f499a47b79

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/TSC.sln
Size

1KB
MD5

a0adcb5d6779e5c43d9838646114fec5
SHA1

7156c5d88e6e3ddf72db976355d6cb2f06beb4c0
SHA256

a41be67ff6675761854fb93f365a25a883e5100535cc63968b2ae3d5171b251c
SHA512

d669c0824007a4a6d06b83646c1772b1c427360731b6dfeca1a06e5fb3f6cc52a1a344f1e0366427f28b960f6ba181ce0a28ad9ff232917af65385dd94dc5cd2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.sln\ = "sln_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\sln_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\sln_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.sln	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\sln_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\sln_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\sln_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\sln_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2856	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2856	AcroRd32.exe
2856	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2840	2512	cmd.exe	31
PID 2512 wrote to memory of 2840	2512	cmd.exe	31
PID 2512 wrote to memory of 2840	2512	cmd.exe	31
PID 2840 wrote to memory of 2856	2840	rundll32.exe	33
PID 2840 wrote to memory of 2856	2840	rundll32.exe	33
PID 2840 wrote to memory of 2856	2840	rundll32.exe	33
PID 2840 wrote to memory of 2856	2840	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bin\TSC.sln
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\bin\TSC.sln
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bin\TSC.sln"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1ac33a81e5f614bb738544483b0146e3

SHA1
aa86236de9398b7a4905bdee7aaffa1b56564d49

SHA256
bed2157a4c09afc370fd4ceae057e1302b606125ba3a5ffa1b2953d0b422b711

SHA512
02074bb6bc2d66605fbfc2f8c0cb45cb2306ea29c4b7ea204c23a6edacea437612bf5bdd3deedb16dc895ac9674faa9719fa4d6cda76bfdddd66273bd509a438

Download Submit