b3628770aaf2246a1fcedfae7e8b7523e962ca49340f6bb881562c0673a4a446

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MalwareDatabase-master/README.md
Size

3KB
MD5

2f0c9dd2a112bf13385a1f57bd284d39
SHA1

83de7791dd6d930cd698edfd7c04f799148c4241
SHA256

cfcb7cd126178d5a18862d3a29640b4d903d58aa74b2892fe3eaec452442dcd0
SHA512

c980ceb58c593484c172f10fc3b9da6ed45e2a4b7d928f47c3c7e4b8965959d9f459d15bc71575ab9f822ea03dbc779d0dde4f4806080cc804600c60fe011f97

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\md_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\md_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2756	AcroRd32.exe
2756	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2764	1400	cmd.exe	32
PID 1400 wrote to memory of 2764	1400	cmd.exe	32
PID 1400 wrote to memory of 2764	1400	cmd.exe	32
PID 2764 wrote to memory of 2756	2764	rundll32.exe	33
PID 2764 wrote to memory of 2756	2764	rundll32.exe	33
PID 2764 wrote to memory of 2756	2764	rundll32.exe	33
PID 2764 wrote to memory of 2756	2764	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MalwareDatabase-master\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MalwareDatabase-master\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MalwareDatabase-master\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
01d8cfda46bf02e2892a152e73e61534

SHA1
f7f7c889b81b5cf376302fc6347de699ca02d3dd

SHA256
264c4248bd9e3105b58747b5cc43627d9b5428b0c5b9bbb0b6500903b3182dfb

SHA512
b4f282e9bbee1997e465cabc0b0d8dffd2a9bb8fed27ec2e623c5d7e4695ef6321a1215b44f371b61d0962d8ae346722903803509f93bf31964163c5c2d87f38

Download Submit