31f00aa4007b149e48d28c341083c2a8d5650fc3db17d4e1b5f2cdb4871a1876

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sol 2.2.9/extension/weather-controllers/sol2/sol__shared_memory__backup.lua
Size

1KB
MD5

7315a7617ec9f7c4f5a7ee3c86eb44ba
SHA1

9ecf4f7a8b0f27542ffa5c51d3a7c5ded22d5cce
SHA256

308cb142d3cbe3f2985ca657f5be8742e4b2117336917b2d667d10884229c246
SHA512

37b391ca497cd2983ac5ad619ce0bd2d467e62193f99f64b10ddfcce6066de93a707702b7e547e20fe36cb63451a73f5542ad95b4a2bf442431e64fa2bc86b09

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.lua\ = "lua_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\lua_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\lua_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\lua_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\lua_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\lua_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.lua	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\lua_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2628	2860	cmd.exe	31
PID 2860 wrote to memory of 2628	2860	cmd.exe	31
PID 2860 wrote to memory of 2628	2860	cmd.exe	31
PID 2628 wrote to memory of 2720	2628	rundll32.exe	33
PID 2628 wrote to memory of 2720	2628	rundll32.exe	33
PID 2628 wrote to memory of 2720	2628	rundll32.exe	33
PID 2628 wrote to memory of 2720	2628	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Sol 2.2.9\extension\weather-controllers\sol2\sol__shared_memory__backup.lua"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Sol 2.2.9\extension\weather-controllers\sol2\sol__shared_memory__backup.lua
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Sol 2.2.9\extension\weather-controllers\sol2\sol__shared_memory__backup.lua"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0164a1b23cf2020c6a603e80582abf60

SHA1
a0e2c774c92b0d3d938f8f462dfb9f478576b5f0

SHA256
bca32a097a69be06726467a4a70948d4e62ef45501dd28b0207b8580c4e63634

SHA512
f8b7d9e1babe8ed45bbf58621603387b741a9c682594e438d84c882ee71700142a70f2729174a1be260b8af2a663a29e64185cd7075e14d88b05e1228f670261

Download Submit