36ea1834880711141b9c8774af22b77b7da92b5e71699cd8e0d330862b4b7a05

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Incognito-main/init_script/modules/environment/instances.luau
Size

10KB
MD5

de035f5400c73b965e6900893ac312f9
SHA1

6325f430ad6d0607f182e106b34d7c37d75abf3f
SHA256

96f853c6e2fe1d9402c25ee1b1850d3fedb1933a780a5b0c4dc857b11c06a2c1
SHA512

2e05f063aa6ac0541c9bc22b8961aedbc76fc82a5b434b2dc8222a43c1c1a97a222d9dcd9bf8dc9a71188d153cb40b61b1b3265791d705b7828dfe0feb948468
SSDEEP

192:DCUIRV9AkVN+1f49mkh8bIozWWi/mmRXSIwbNjM8HI:DCUIbT9mkO7W/msXd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\luau_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\luau_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\luau_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.luau	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\luau_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\luau_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.luau\ = "luau_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\luau_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2704	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2704	AcroRd32.exe
2704	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2740	3044	cmd.exe	31
PID 3044 wrote to memory of 2740	3044	cmd.exe	31
PID 3044 wrote to memory of 2740	3044	cmd.exe	31
PID 2740 wrote to memory of 2704	2740	rundll32.exe	32
PID 2740 wrote to memory of 2704	2740	rundll32.exe	32
PID 2740 wrote to memory of 2704	2740	rundll32.exe	32
PID 2740 wrote to memory of 2704	2740	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Incognito-main\init_script\modules\environment\instances.luau
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Incognito-main\init_script\modules\environment\instances.luau
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Incognito-main\init_script\modules\environment\instances.luau"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
24e06fea40d708f3299904fea0302cfa

SHA1
9e131dd1b2cb086ba21c98f0c10439bfe3b34196

SHA256
9c9a3d5d6da4ba4d86b112d7a773098376af238156856a3833debdec0b42bd1f

SHA512
376f5baf64c276e05f0cea0a0592ed395df6dfc85cc5aee38f735a67d1e9817519847e0ce90444260c83eaa20da5876f34411b310a8bd6a58588f3c0bf88fbf6

Download Submit