645e274fec3723d065308f9b16b33392ed7f51fbd5ffc3c00806c2efafb08b65

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gui.lua
Size 15KB
Sample240719-npr1jascqa
SHA256 1cefe4067f5dfa55873072a76b5b766f19115550cd405b6eee9d222d9bd5436d
MD5 3fbaf076d7134a8aee08b42125cdef51
SHA1 54a9d8bdda809ec0b40e574f1ebed8e39b0f166a
SHA512 649e252af9f88d72827907bfce085e28d5309b7d9cade27fd652cb4ecf5645f040842c4b9f13f4239bf8b5f4ceaa219c3f8ef4aa5dcd92a6c44cd9948580875b
SSDEEP 192:QC8HPhbdPHR/LvS5ZiLRRi6tAExVWkHbWRRQxQIXjWYUNPJodWtHS8HT:QVRxRjv/mCxJdzzIZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.lua	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\lua_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\lua_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\lua_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.lua\ = "lua_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\lua_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\lua_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\lua_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2168	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2168	AcroRd32.exe
2168	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2844	2332	cmd.exe	31
PID 2332 wrote to memory of 2844	2332	cmd.exe	31
PID 2332 wrote to memory of 2844	2332	cmd.exe	31
PID 2844 wrote to memory of 2168	2844	rundll32.exe	32
PID 2844 wrote to memory of 2168	2844	rundll32.exe	32
PID 2844 wrote to memory of 2168	2844	rundll32.exe	32
PID 2844 wrote to memory of 2168	2844	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\gui.lua
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\gui.lua
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\gui.lua"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 ba3dd3555c2453ec7a4969daa869fb739a44bc4fb735da1da754d45dc1076225
MD5 b58795fbdecc5a1f20d0c1228ec1579c
SHA1 e45d95c03836f1b52c43c12cefda3c52e7d01020
SHA512 2087c16a37db8bd52c59be37075169cf541689e21f9b84c00eed7f2bda9552a22773bfddd792c66e68ef0c7db10452c16e023bc542e56146ac4ab4a6a153356a
MD5 SHA1 SHA512

Submit Download