b7111d51e5a77bca18ad278cee2b990937ab9e23d58b60f7d6f16093a0971906

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dheater-0.4.3/.gitignore
Size

155B
MD5

6c1d92af8d21374c70df614fbbd29060
SHA1

b0f5d8134bcbdfcb460831966c3bb2f42c7d2f71
SHA256

e3468f6951eed834ea509dee417f25ac750feede4105fe2660867618048459ee
SHA512

6884745c9766cb408668f73c83b83d99b6b330e4f5b6f000989acf54983cc604784f0fb597443cf6e03fef25dd41ff8c60746e5f28a5b816326fc42ad8b2c028

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\gitignore_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\gitignore_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.gitignore	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\gitignore_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\gitignore_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\gitignore_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.gitignore\ = "gitignore_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\gitignore_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2660	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2660	AcroRd32.exe
2660	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2240	2924	cmd.exe	32
PID 2924 wrote to memory of 2240	2924	cmd.exe	32
PID 2924 wrote to memory of 2240	2924	cmd.exe	32
PID 2240 wrote to memory of 2660	2240	rundll32.exe	33
PID 2240 wrote to memory of 2660	2240	rundll32.exe	33
PID 2240 wrote to memory of 2660	2240	rundll32.exe	33
PID 2240 wrote to memory of 2660	2240	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dheater-0.4.3\.gitignore
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\dheater-0.4.3\.gitignore
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dheater-0.4.3\.gitignore"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d2802f60397af6aa96e3614b0dfab189

SHA1
abc9d3beb8b7c64a693360d1d2c24277046084d8

SHA256
e02c9c6ae4aac101c82ec0d0240096bf6c41ea70c2b7152b26b707ce92d04f9b

SHA512
772a9e6f01a905d9506fbb9a89371878b2d8bb4ed5e7bcd6df8857d301266cc4cdd09a0ddd682ce51c45f509abd496d7270d28532cc483af3c5e8d5ee8ac1fa6

Download Submit