31f00aa4007b149e48d28c341083c2a8d5650fc3db17d4e1b5f2cdb4871a1876

Analysis

max time kernel
102s
max time network
28s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sol 2.2.9/extension/weather/simplePPoff/weather.lua
Size

5KB
MD5

b3023c81bf2939746a922b541ae1bcd9
SHA1

0d7e86b8d4126cb09128bc46453341cd296533e1
SHA256

8c63e10b84a0d3080a1e8cf39ed87ed10025f6aa6dea0433d5f6bdd4a2778aae
SHA512

9517ddccddb62d2ede7a04291411e028e78cca6dd8c06da2735a3597d3a31734093617a96e5950866c0434b7edc70fae07fe70885ef7ed68cfc59aea7590324c
SSDEEP

96:0K6LwYuF1IH9NDlkQpEpcNoLn3qIP4tt6+ZLIJRby3l8Z9guLNgfGINuNHN0gJdV:0KG7TdNDdpEiNE3dP88/9XLNglNuNHN1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\lua_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\lua_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\lua_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\lua_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.lua	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.lua\ = "lua_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\lua_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\lua_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2888	AcroRd32.exe
2888	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2864	1628	cmd.exe	30
PID 1628 wrote to memory of 2864	1628	cmd.exe	30
PID 1628 wrote to memory of 2864	1628	cmd.exe	30
PID 2864 wrote to memory of 2888	2864	rundll32.exe	31
PID 2864 wrote to memory of 2888	2864	rundll32.exe	31
PID 2864 wrote to memory of 2888	2864	rundll32.exe	31
PID 2864 wrote to memory of 2888	2864	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Sol 2.2.9\extension\weather\simplePPoff\weather.lua"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Sol 2.2.9\extension\weather\simplePPoff\weather.lua
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Sol 2.2.9\extension\weather\simplePPoff\weather.lua"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ebfaaef3e0431d224c4d5f7fa48ba720

SHA1
89f9b2a987620b27d0c6d4f9a7e70377d5fb1da6

SHA256
23d16e68d0e9c4d6fe22b071e861a693a0db661623229c75d1fe4e7f1b24a482

SHA512
9860590631808103489decf03326cf71931288899754886524fc89aada4d66d3df9c46f734a76210a128f728690d55b266b995b6dc74c8dd91b79aadf27514bb

Download Submit