b5d324e0527b5516511e3ac8243d68b7eb253e56a9ca869c02a62874297ab6f5

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Script (3.2a)/scripts/script.gscbin
Size

6KB
MD5

e42b5ea570de233e3be9d052969e877a
SHA1

0e20885da049fc8e460da56ddf06b5a2673ef893
SHA256

7425b6fcacd727b8979d0884dccc1f053ce8fffd82c110694d37877a82e5f58f
SHA512

2e4e610b1f2af4a81bd5cd8b3746a58ea843fc2fdf9298d9ada2c8b230b4b1620c80ab0d01c334f41f41dd51ae4664324e7c585a54e3e11d838b014b9731d188
SSDEEP

96:zn+0/8BNd7V/aVwwSrh12nEUf6ILRerdezV4/zrKbW1:3E6wwUq1erdezkzrB

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\gscbin_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\gscbin_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\gscbin_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\gscbin_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.gscbin	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.gscbin\ = "gscbin_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\gscbin_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\gscbin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2880	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2880	AcroRd32.exe
2880	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2284	2484	cmd.exe	31
PID 2484 wrote to memory of 2284	2484	cmd.exe	31
PID 2484 wrote to memory of 2284	2484	cmd.exe	31
PID 2284 wrote to memory of 2880	2284	rundll32.exe	33
PID 2284 wrote to memory of 2880	2284	rundll32.exe	33
PID 2284 wrote to memory of 2880	2284	rundll32.exe	33
PID 2284 wrote to memory of 2880	2284	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Script (3.2a)\scripts\script.gscbin"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Script (3.2a)\scripts\script.gscbin
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Script (3.2a)\scripts\script.gscbin"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3966443c531a30558c02470c4cb1b780

SHA1
06b40b6485f15835c514f2694d0afca6d22252e0

SHA256
5254c04b98e630efbc626af103df6dd418c5e69c8ea39166bca41c92fc3df1fb

SHA512
fc5ebaaa5920548c06ec5f3f2899df31c6c6bdc2cc3e5918eeb410de2edc6f883f57c0bd772ad656f2c84f64faeefc07bccb12dbf2f987208b03c29ac3eb18f0

Download Submit