baecfee04aac1e25d9049eff567da8007ca2a490401f954cc66f6a4279433cb6

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 18:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Oxigen/Monaco/fileaccess/node_modules/raw-body/SECURITY.md
Size

21B
MD5

c32fba8f9ab389a6f0b25e79eb105910
SHA1

d4b181d213da4ab71d816359bffa95a02771e9f6
SHA256

a6f46a90d7946634c1556c4c561defdae6b5e99acc0250988c23d0a35bbae603
SHA512

9485e774e465f52a58f213d1a222ab53cb75e7823dadbdd017f5cc5940c2ecd0a38d08fee835e588baba94dd62a34664a6373ea63e1ee09dd8e74b98cb43abc0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\md_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\md_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.md	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2752	AcroRd32.exe
2752	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1300	2032	cmd.exe	31
PID 2032 wrote to memory of 1300	2032	cmd.exe	31
PID 2032 wrote to memory of 1300	2032	cmd.exe	31
PID 1300 wrote to memory of 2752	1300	rundll32.exe	33
PID 1300 wrote to memory of 2752	1300	rundll32.exe	33
PID 1300 wrote to memory of 2752	1300	rundll32.exe	33
PID 1300 wrote to memory of 2752	1300	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Oxigen\Monaco\fileaccess\node_modules\raw-body\SECURITY.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Oxigen\Monaco\fileaccess\node_modules\raw-body\SECURITY.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Oxigen\Monaco\fileaccess\node_modules\raw-body\SECURITY.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
df16cf14a2b9695cec4f5f06cc50b029

SHA1
5acde23e7748a6688fd45ab5a5513dc2a1d928da

SHA256
97b450dd67b5e5c667f0acb649808435beb9185eaae7384ed4202d04875e2f45

SHA512
7e19e4a64cdcf86be9ba97b5990f3406cf8ed5e5097b64cee4234b03b8df08527cb8a3a24c49bf425bd1cdc163977dbf77dda735ba1b37b4449f42d627823ffc

Download Submit