92e9e6765bf36034b5eba64e2609a4f53cbb4d8e234d06286504167a1ed39c62

Resubmissions

18/08/2024, 12:39

240818-pv2btstdrc 8

18/08/2024, 12:38

240818-pt66patdph 8

Analysis

max time kernel
102s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/luascripts/animations/walkthrough.lua
Size

213B
MD5

9163555c03919dd219ea4d9148eb8197
SHA1

1f11d683f759202e477159da3821efb3717e0f2a
SHA256

bdbb65085c0243f9bbb52e93a69a986124454d9ecee5c715e3f2dcd945b55d7c
SHA512

d0bba456a6c25e6e8e45576a5a9d2f98bb803ff0ee1fa725a3c6fbca0bf58d4fae516fdc5b8a5db4ac32c68c4e2fc6d1acdf4b20444c1100e8a6ae87671f5050

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\lua_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.lua	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.lua\ = "lua_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\lua_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\lua_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\lua_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\lua_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\lua_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2824	2540	cmd.exe	30
PID 2540 wrote to memory of 2824	2540	cmd.exe	30
PID 2540 wrote to memory of 2824	2540	cmd.exe	30
PID 2824 wrote to memory of 2720	2824	rundll32.exe	31
PID 2824 wrote to memory of 2720	2824	rundll32.exe	31
PID 2824 wrote to memory of 2720	2824	rundll32.exe	31
PID 2824 wrote to memory of 2720	2824	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\resources\luascripts\animations\walkthrough.lua
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\resources\luascripts\animations\walkthrough.lua
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\resources\luascripts\animations\walkthrough.lua"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b33e0ffcc04cea6dbdda73514d145b9e

SHA1
e261502584b0f3c3737820e35f2b4f5c68303bb2

SHA256
53afeb1d40e080d9c0c210b6af4163322a38e2276aa975a5091f7662f44afd67

SHA512
042622937b67e1ee15418a04b9eb9be86015e623c58d37f448d059ddff96bfb2e7a0e1366dd6705d61803827c223acc83054aa0945c5e8b164f22efdff4fd861

Download Submit