59d0d595dec18db09db65df7c1b3cae6627a0721d82bde81b260fff86844717e

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpeQ Mathematics/examples/defining variables.spq
Size

1KB
MD5

4bb03cc438690f05ce2a044fb01824d2
SHA1

b7ac4817910620d6f873ddf1a5275a2b37797c0c
SHA256

eb088777d98db88c2bd37b3fd58ca37c9247676debbc8ce7ad7465b83e328626
SHA512

1c95ea7bfc3356bb6d457aac56649f8b754c66ec10874078b91cbdf50f8290762a0865369365d24df5d6e47a09715b1ed0f65333ddf499065e42aaab23b1f5ec

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\spq_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.spq	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.spq\ = "spq_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\spq_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\spq_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\spq_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\spq_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\spq_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2368	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2368	AcroRd32.exe
2368	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2304	2544	cmd.exe	31
PID 2544 wrote to memory of 2304	2544	cmd.exe	31
PID 2544 wrote to memory of 2304	2544	cmd.exe	31
PID 2304 wrote to memory of 2368	2304	rundll32.exe	32
PID 2304 wrote to memory of 2368	2304	rundll32.exe	32
PID 2304 wrote to memory of 2368	2304	rundll32.exe	32
PID 2304 wrote to memory of 2368	2304	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SpeQ Mathematics\examples\defining variables.spq"
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SpeQ Mathematics\examples\defining variables.spq
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SpeQ Mathematics\examples\defining variables.spq"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
30c32cc8f88306b96ae78dabb4f6c5c0

SHA1
cef4ab717f8c529558b27b88a21f709075cdd07b

SHA256
5c5d5d4f6d23a3ae571f68776280fbf7cb9a8f26a94478dc772c0d3b41f2c980

SHA512
e3364841502e2c31c8a3c1be05d4bd62d7dfcce0137d1cea08010da1f6e344df29c5ccc1d947e03aecc8bfb4c2a84578eb6d782a93c41efca9c0b0875c3bab49

Download Submit