0bfb27b54dac411199bbc5de2f925c2435fbe6bcbaf9175598af7a073e8a8e55

Analysis

max time kernel
121s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MelvorIdle-oyunindir.vip/package.nw/node_modules/file-uri-to-path/History.md
Size

433B
MD5

25d3074d5f78a4850cbfe4888e3b0c22
SHA1

b505e32eb72e65a8455f678a99f07ff0b72240ed
SHA256

0b06e981a4318af1daef8b6ef0c6ff794e9b18a0a3e0738a65c9063988016d2e
SHA512

89edaaa873b74d425bd0c396860517811eb16321cddcb36ec24067d3795da7281797d80e30ec16a7a5deb831a735e1a75350756496b6726777fc8387bcd307e8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\md_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2696	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2696	AcroRd32.exe
2696	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2700	2112	cmd.exe	32
PID 2112 wrote to memory of 2700	2112	cmd.exe	32
PID 2112 wrote to memory of 2700	2112	cmd.exe	32
PID 2700 wrote to memory of 2696	2700	rundll32.exe	33
PID 2700 wrote to memory of 2696	2700	rundll32.exe	33
PID 2700 wrote to memory of 2696	2700	rundll32.exe	33
PID 2700 wrote to memory of 2696	2700	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MelvorIdle-oyunindir.vip\package.nw\node_modules\file-uri-to-path\History.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MelvorIdle-oyunindir.vip\package.nw\node_modules\file-uri-to-path\History.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MelvorIdle-oyunindir.vip\package.nw\node_modules\file-uri-to-path\History.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8d0ef0c53905271befb20e3b0d06814c

SHA1
eba84ee2c820d40e1a30ffa7d9e04da9eef042e9

SHA256
e611eb47d2f698d4165fd9470ef7592086f8a527231215611c8f3aa191f1be40

SHA512
6fa2ffdf1e2d905f33c7709d7e5ad52d26b72c631acf1449eeb4bb77101ff8dcc488d60c475df22e0248ced1320c254e86136c0c0013a88bc68edfafe0fd422d

Download Submit