31f00aa4007b149e48d28c341083c2a8d5650fc3db17d4e1b5f2cdb4871a1876

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sol 2.2.9/extension/weather-controllers/sol2/sol__shared_memory__backup.lua
Size

1KB
MD5

7315a7617ec9f7c4f5a7ee3c86eb44ba
SHA1

9ecf4f7a8b0f27542ffa5c51d3a7c5ded22d5cce
SHA256

308cb142d3cbe3f2985ca657f5be8742e4b2117336917b2d667d10884229c246
SHA512

37b391ca497cd2983ac5ad619ce0bd2d467e62193f99f64b10ddfcce6066de93a707702b7e547e20fe36cb63451a73f5542ad95b4a2bf442431e64fa2bc86b09

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\lua_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\lua_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.lua	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.lua\ = "lua_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\lua_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\lua_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\lua_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\lua_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2696	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2696	AcroRd32.exe
2696	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2740	3044	cmd.exe	31
PID 3044 wrote to memory of 2740	3044	cmd.exe	31
PID 3044 wrote to memory of 2740	3044	cmd.exe	31
PID 2740 wrote to memory of 2696	2740	rundll32.exe	32
PID 2740 wrote to memory of 2696	2740	rundll32.exe	32
PID 2740 wrote to memory of 2696	2740	rundll32.exe	32
PID 2740 wrote to memory of 2696	2740	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Sol 2.2.9\extension\weather-controllers\sol2\sol__shared_memory__backup.lua"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Sol 2.2.9\extension\weather-controllers\sol2\sol__shared_memory__backup.lua
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Sol 2.2.9\extension\weather-controllers\sol2\sol__shared_memory__backup.lua"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2946825c6d0932e5a42755ed62f2b4f6

SHA1
8af212133fad7cdaf7e3ec4873be51b3759987e1

SHA256
6de3797293a6f3a191cd058e8e622680ebf545eeda6027b996db8a5da6b0be00

SHA512
e03646976dad0fcaa511089cd9421fe23cb8c2f0c1cff2a7acdc292c0e5c33d1208053c40387b70827ba1d25f9e2b4700de48254a435754cfcfa04dcaff00cd8

Download Submit