db63c3aa053d5dd2f43d79ee907ae8c5fbb4d39b7e4ecd26296717ee64bc119b

Analysis

max time kernel
103s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Brookhaven-7ScriptsMenu-main/README.md
Size

696B
MD5

ce064b44174b84f7f0fee9b7e3a3cfac
SHA1

d9f8dd6c69e89b227f6d577c67836cbef805367b
SHA256

7d94737c96923bc9c52a69eed350862f466309ebe11f2ed5a9fcddd3b7ed094c
SHA512

997922b185a294fb088e648764e857210621d3d7c5a8648fb5989ec4d6c0978d863c2283d0a5317de7322f4bd47ef2c408ecfd1fe3b0c47196cbaae5cf2cd35c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\md_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.md	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\md_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2672	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2672	AcroRd32.exe
2672	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2800	1292	cmd.exe	31
PID 1292 wrote to memory of 2800	1292	cmd.exe	31
PID 1292 wrote to memory of 2800	1292	cmd.exe	31
PID 2800 wrote to memory of 2672	2800	rundll32.exe	32
PID 2800 wrote to memory of 2672	2800	rundll32.exe	32
PID 2800 wrote to memory of 2672	2800	rundll32.exe	32
PID 2800 wrote to memory of 2672	2800	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Brookhaven-7ScriptsMenu-main\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Brookhaven-7ScriptsMenu-main\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Brookhaven-7ScriptsMenu-main\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fd944b9b1096bf57c3f2f34f1f313829

SHA1
df4f882d126803d28fde95efacbe6cb927c237bc

SHA256
de25c1803e5ba7acc82452efda007e37fa66944d4014153c954e8a455bcab993

SHA512
1de1563aa8fca35110cc56aab57b7de62f70bf5bbfb2c001ef46e4ab506ec30bbdd74b8e1e10ab0ee2073d66c0bd6ae69883916eb03e3ad821dd0ddcb67e66c3

Download Submit