Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/07/2024, 08:06

General

  • Target

    ampscripts.tar.gz

  • Size

    22.2MB

  • MD5

    ba076bac396e719d5cc23494ea4bc932

  • SHA1

    62d179108eeb87f1757e82ecffba764e51d5788f

  • SHA256

    442bc1d9cc915c514f56d07d44d05d8caab80ae521e29f5a2a3b54058d77aa95

  • SHA512

    c3eee81870b85b9571335c0029a4526263572d628a5676a90f67af5983c734d27f03d724d95b985fee17e6d4196e6ea285560dbaf056d2c96a56cf7c569bb9be

  • SSDEEP

    393216:CSCkKbJcPGGf2Yd/TL33ThnMfCO6vr22eGudbkSK9ubnTg9volOCWyWiVnp2D+r+:CMKNCGGuYnMKvrNlu1kyTguFWyJVp2K+

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\ampscripts.tar.gz
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ampscripts.tar.gz
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ampscripts.tar.gz
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2208
        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ampscripts.tar.gz"
          4⤵
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          PID:352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    1538719d549bbd91a066f396e78bb184

    SHA1

    cd88a7289ac1e546972a66c877cb6c5dc0279273

    SHA256

    aaee6742bffb4da48244bf511b3f7beafe5e077973cfc1e5d106e77a2c89dd8f

    SHA512

    a9cb7c3903b5fbd6b68447bee662092fba12597397c7523989d97adbd03a715f7ba95e41ffb7c02cc464c26448b61d22c5d6a0096be73e9867e9aa9f5b33a123