442bc1d9cc915c514f56d07d44d05d8caab80ae521e29f5a2a3b54058d77aa95

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ampscripts.tar.gz
Size

22.2MB
MD5

ba076bac396e719d5cc23494ea4bc932
SHA1

62d179108eeb87f1757e82ecffba764e51d5788f
SHA256

442bc1d9cc915c514f56d07d44d05d8caab80ae521e29f5a2a3b54058d77aa95
SHA512

c3eee81870b85b9571335c0029a4526263572d628a5676a90f67af5983c734d27f03d724d95b985fee17e6d4196e6ea285560dbaf056d2c96a56cf7c569bb9be
SSDEEP

393216:CSCkKbJcPGGf2Yd/TL33ThnMfCO6vr22eGudbkSK9ubnTg9volOCWyWiVnp2D+r+:CMKNCGGuYnMKvrNlu1kyTguFWyJVp2K+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
352	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
352	AcroRd32.exe
352	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2692	2808	cmd.exe	32
PID 2808 wrote to memory of 2692	2808	cmd.exe	32
PID 2808 wrote to memory of 2692	2808	cmd.exe	32
PID 2692 wrote to memory of 2208	2692	rundll32.exe	33
PID 2692 wrote to memory of 2208	2692	rundll32.exe	33
PID 2692 wrote to memory of 2208	2692	rundll32.exe	33
PID 2208 wrote to memory of 352	2208	rundll32.exe	35
PID 2208 wrote to memory of 352	2208	rundll32.exe	35
PID 2208 wrote to memory of 352	2208	rundll32.exe	35
PID 2208 wrote to memory of 352	2208	rundll32.exe	35

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ampscripts.tar.gz
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ampscripts.tar.gz
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ampscripts.tar.gz
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ampscripts.tar.gz"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1538719d549bbd91a066f396e78bb184

SHA1
cd88a7289ac1e546972a66c877cb6c5dc0279273

SHA256
aaee6742bffb4da48244bf511b3f7beafe5e077973cfc1e5d106e77a2c89dd8f

SHA512
a9cb7c3903b5fbd6b68447bee662092fba12597397c7523989d97adbd03a715f7ba95e41ffb7c02cc464c26448b61d22c5d6a0096be73e9867e9aa9f5b33a123

Download Submit