b7111d51e5a77bca18ad278cee2b990937ab9e23d58b60f7d6f16093a0971906

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dheater-0.4.3/README.md
Size

760B
MD5

4f1fa5dc02687a991e4ee2fd547742e0
SHA1

827a48f650a5c7e6325189a0f435c4c06b5d780c
SHA256

7a9e87e794ffcaca2bf2ec50fd5843b6e19c77cc308a3314bb3e4fc3acf94b8e
SHA512

c2b1f25af5be8a6a26435e084b01e2e6fd9e0c4c0560537ab75a054bcbcd216f32d5cdd4d506cfacae9955225af199b7ed3f191a4c9b35c5c464cf8610b663a3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\md_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2772	AcroRd32.exe
2772	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3032	2956	cmd.exe	32
PID 2956 wrote to memory of 3032	2956	cmd.exe	32
PID 2956 wrote to memory of 3032	2956	cmd.exe	32
PID 3032 wrote to memory of 2772	3032	rundll32.exe	33
PID 3032 wrote to memory of 2772	3032	rundll32.exe	33
PID 3032 wrote to memory of 2772	3032	rundll32.exe	33
PID 3032 wrote to memory of 2772	3032	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dheater-0.4.3\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\dheater-0.4.3\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dheater-0.4.3\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
96ec247cf9a573ea257d2cca746da2eb

SHA1
dcf9a889745a43755ff4cf148b8faa634835697f

SHA256
fc8cc2022741a37cc531327065ccec3b267d6ad8105f5d5d697b694463ae2866

SHA512
330fd79d26e362f7e7685d16e8799ab5527a3511c8db9c699f3083e94a63f0837617bb1ce24429cab60c4d4bb99ceb8a5fbe97642603566a6504b17ecd830612

Download Submit