645e274fec3723d065308f9b16b33392ed7f51fbd5ffc3c00806c2efafb08b65

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

internal/extensions/Vector.lua
Size

576B
MD5

7e3a9e43cbcc2f696d3fe5e98c25bd40
SHA1

b8bb6f8641b2ca5bddf80093bdaa29aa1f17806c
SHA256

32eb9be018ee9e6acc74b70a6658daa1517590c6d9a67bf42d1ea1b1226271fe
SHA512

06e7c53a14fe1b5ea7b00deb33f2370738722933bcf034c6722dc62f0008212ef8cfb3cfc7cfe8e5f7d04b324d7de2b4fe0767b87366133e278f8fdd1e8e952c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\lua_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.lua	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.lua\ = "lua_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\lua_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\lua_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\lua_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\lua_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\lua_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2428	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2428	AcroRd32.exe
2428	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1176	2448	cmd.exe	29
PID 2448 wrote to memory of 1176	2448	cmd.exe	29
PID 2448 wrote to memory of 1176	2448	cmd.exe	29
PID 1176 wrote to memory of 2428	1176	rundll32.exe	30
PID 1176 wrote to memory of 2428	1176	rundll32.exe	30
PID 1176 wrote to memory of 2428	1176	rundll32.exe	30
PID 1176 wrote to memory of 2428	1176	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\internal\extensions\Vector.lua
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\internal\extensions\Vector.lua
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\internal\extensions\Vector.lua"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8065bba58fe6583f47c2739a00631ccc

SHA1
63c328aafcfca27b7a37444c08b7f876e807ee09

SHA256
b658845eed7cc13e282ebfd48b154007c75f4e285b280937ece0697fcfb24cae

SHA512
2ffea194a8d4a0f0f348b990ca7b5d242a69a7785640e205f7e954f12717c4f3493c0f731c0b31d3df00b75fde2962fddbe03bd83618cb459f48136eee214970

Download Submit