e91056d140d4b1f647fa92d6ddab5c986c8eb54f738f8c84ce0de009ba901580

Resubmissions

21/07/2024, 19:41

240721-yehdfs1epe 1

21/07/2024, 19:41

240721-yd3m1a1ene 7

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

src/css/bootstrap.min.css.map
Size

418KB
MD5

234d916a5336ae521b932c6c7d373467
SHA1

21a60d8887bcccb6a6705afcecc9eaa7f02f4f5a
SHA256

5ab28efe2b9b0e054221b966c9b1cc18d0d68cc0d44c7c6c32f9fb34672163cc
SHA512

71062456cf3532430e50863c15b573bee007156a4c6e1dcea4d08e96f25f713f184b709eb4eeb9df7cf59351cc35b8313d906d36cf0ed7683ca4a24c4a8d5d8b
SSDEEP

6144:iUe2aZgPb2PH5lliWLuxjoVgrf8ZhGW4STALycfE6xNcVrRQ:cZgbWLuxjoVgrf8ZGSTALycfE6xNadQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\map_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.map	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.map\ = "map_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\map_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\map_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\map_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\map_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\map_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2836	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2836	AcroRd32.exe
2836	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2980	1596	cmd.exe	31
PID 1596 wrote to memory of 2980	1596	cmd.exe	31
PID 1596 wrote to memory of 2980	1596	cmd.exe	31
PID 2980 wrote to memory of 2836	2980	rundll32.exe	32
PID 2980 wrote to memory of 2836	2980	rundll32.exe	32
PID 2980 wrote to memory of 2836	2980	rundll32.exe	32
PID 2980 wrote to memory of 2836	2980	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\src\css\bootstrap.min.css.map
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\src\css\bootstrap.min.css.map
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\src\css\bootstrap.min.css.map"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
358c109185664e96779102bb7a724633

SHA1
9753536b654e7d70514da8907a6b1d71cdf07246

SHA256
7b61e1843bedbbede392599723a7f4a4953a5d9163122327b75ac154a11379a9

SHA512
bb1f81eefa9f420642d2d55c0622a9169ed8f994c79a3ee107d9a6ef40c6735b5c7d08d6042a6fda5a0d6ee37069ddc6c4c7cf9d4d7ae0c32fd4d9d39e664d41

Download Submit