Resubmissions

30-08-2024 17:58

240830-wkhv3axbkh 8

30-08-2024 17:38

240830-v7p28axcnp 3

30-08-2024 17:34

240830-v5fe1awcrh 1

30-08-2024 17:29

240830-v2wykswbrf 8

30-08-2024 17:24

240830-vywteawape 8

30-08-2024 17:19

240830-vvtvmsvhlg 8

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    30-08-2024 17:38

General

  • Target

    apt/sources.list

  • Size

    255B

  • MD5

    3f812a2012f84534228c448fd4d3e96e

  • SHA1

    92fff2bf3f7cc9760e98fa5205d7f644b10fc2c5

  • SHA256

    6698cf04ed4c3871554c24dcf05fbaa36f0db87330ac58441a6a841a671b4f58

  • SHA512

    cc243a6a1d0fb7199ad05c2854860d1357a8a86605ac08d840bc450a88e51a1ecb1de48d1c46b07f846248bc80fb6df94a0318ac42711e3b985ca1836e7cfcd5

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\apt\sources.list
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\apt\sources.list
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1800
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\apt\sources.list"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    c6637ab7e24adbc689de4c15bf8bf271

    SHA1

    e9c719b37b76924940dfd367fec0043cb3a94631

    SHA256

    83df282b9826624c31a3b92f6c6ef9ae4a85c12ac1a97e6df2ad207589cb47d7

    SHA512

    f52174d0b10524e6d582d516f1fe835bcaa4696a893b2db9989b2a1c891f66d1c6b5f71bfb6aff9c61da95520e6b4ab487e1b2836b89c4c8aaa60322d787563f