0bfb27b54dac411199bbc5de2f925c2435fbe6bcbaf9175598af7a073e8a8e55

Analysis

max time kernel
120s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MelvorIdle-oyunindir.vip/package.nw/node_modules/discord-rpc/.github/FUNDING.yml
Size

696B
MD5

02295c1917650dfe08fce8dbba666042
SHA1

3633265f84b691d73013d19bf7f845da6aadc69f
SHA256

91057675d82b2fd07d4ba062312081f8d229912df3022fa00b11901a40adcc0f
SHA512

730febd7d2918c63204b8c351466e275820f9d5be012b5c26f1cc375afc8d97363b36d66d7de81a0af9a0c79933ea2313b0f200944f34dcc2f1a5b75be7a76da

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\yml_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.yml	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\yml_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\yml_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\yml_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.yml\ = "yml_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\yml_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\yml_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1992	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1992	AcroRd32.exe
1992	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 2256	672	cmd.exe	31
PID 672 wrote to memory of 2256	672	cmd.exe	31
PID 672 wrote to memory of 2256	672	cmd.exe	31
PID 2256 wrote to memory of 1992	2256	rundll32.exe	32
PID 2256 wrote to memory of 1992	2256	rundll32.exe	32
PID 2256 wrote to memory of 1992	2256	rundll32.exe	32
PID 2256 wrote to memory of 1992	2256	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MelvorIdle-oyunindir.vip\package.nw\node_modules\discord-rpc\.github\FUNDING.yml
1⤵
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MelvorIdle-oyunindir.vip\package.nw\node_modules\discord-rpc\.github\FUNDING.yml
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MelvorIdle-oyunindir.vip\package.nw\node_modules\discord-rpc\.github\FUNDING.yml"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
12a437b101e7bd15770e6b079bda9db6

SHA1
5c241ce0f51b33afa720185c42602437355a4029

SHA256
353cecde619ba9e8d41ff79dfbbc86c89b65060f172d12230b2661d18536249d

SHA512
70b1b6a93527a9332df0e711e18acc0cd5f0be0d36a655769a21d35dfcf8db45182d2dd0324971452016749de6feb43945a142c05f86ebdaf05a3bd2db93722e

Download Submit