Overview
overview
3Static
static
1e-Szigno R...17.crt
windows7-x64
1e-Szigno R...17.crt
windows10-2004-x64
1ePKI Root ...ty.crt
windows7-x64
1ePKI Root ...ty.crt
windows10-2004-x64
1emSign ECC...C3.crt
windows7-x64
1emSign ECC...C3.crt
windows10-2004-x64
1emSign ECC...G3.crt
windows7-x64
1emSign ECC...G3.crt
windows10-2004-x64
1emSign Roo...C1.crt
windows7-x64
1emSign Roo...C1.crt
windows10-2004-x64
1emSign Roo...G1.crt
windows7-x64
1emSign Roo...G1.crt
windows10-2004-x64
1pop-suppor...tar.xz
windows7-x64
3pop-suppor...tar.xz
windows10-2004-x64
3pop-suppor...96.tar
windows7-x64
3pop-suppor...96.tar
windows10-2004-x64
3apt/history.log
windows7-x64
1apt/history.log
windows10-2004-x64
1apt/sources.list
windows7-x64
3apt/sources.list
windows10-2004-x64
3apt/source...ources
windows7-x64
3apt/source...ources
windows10-2004-x64
3apt/source...ources
windows7-x64
3apt/source...ources
windows10-2004-x64
3apt/source...ources
windows7-x64
3apt/source...ources
windows10-2004-x64
3apt/term.log
windows7-x64
1apt/term.log
windows10-2004-x64
1boot-process-times
windows7-x64
1boot-process-times
windows10-2004-x64
1crypttab
windows7-x64
1crypttab
windows10-2004-x64
1Resubmissions
30-08-2024 17:58
240830-wkhv3axbkh 830-08-2024 17:38
240830-v7p28axcnp 330-08-2024 17:34
240830-v5fe1awcrh 130-08-2024 17:29
240830-v2wykswbrf 830-08-2024 17:24
240830-vywteawape 830-08-2024 17:19
240830-vvtvmsvhlg 8Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
30-08-2024 17:38
Static task
static1
Behavioral task
behavioral1
Sample
e-Szigno Root CA 2017.crt
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
e-Szigno Root CA 2017.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ePKI Root Certification Authority.crt
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
ePKI Root Certification Authority.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
emSign ECC Root CA - C3.crt
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
emSign ECC Root CA - C3.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
emSign ECC Root CA - G3.crt
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
emSign ECC Root CA - G3.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
emSign Root CA - C1.crt
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
emSign Root CA - C1.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
emSign Root CA - G1.crt
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
emSign Root CA - G1.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
pop-support_1665955296.tar.xz
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
pop-support_1665955296.tar.xz
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
pop-support_1665955296.tar
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
pop-support_1665955296.tar
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
apt/history.log
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
apt/history.log
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
apt/sources.list
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
apt/sources.list
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
apt/sources.list.d/pop-os-apps.sources
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
apt/sources.list.d/pop-os-apps.sources
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
apt/sources.list.d/pop-os-release.sources
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
apt/sources.list.d/pop-os-release.sources
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
apt/sources.list.d/system.sources
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
apt/sources.list.d/system.sources
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
apt/term.log
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
apt/term.log
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
boot-process-times
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
boot-process-times
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
crypttab
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
crypttab
Resource
win10v2004-20240802-en
General
-
Target
apt/sources.list
-
Size
255B
-
MD5
3f812a2012f84534228c448fd4d3e96e
-
SHA1
92fff2bf3f7cc9760e98fa5205d7f644b10fc2c5
-
SHA256
6698cf04ed4c3871554c24dcf05fbaa36f0db87330ac58441a6a841a671b4f58
-
SHA512
cc243a6a1d0fb7199ad05c2854860d1357a8a86605ac08d840bc450a88e51a1ecb1de48d1c46b07f846248bc80fb6df94a0318ac42711e3b985ca1836e7cfcd5
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\list_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\list_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\list_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.list rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\list_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\list_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.list\ = "list_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\list_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2776 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2776 AcroRd32.exe 2776 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2488 wrote to memory of 1800 2488 cmd.exe 32 PID 2488 wrote to memory of 1800 2488 cmd.exe 32 PID 2488 wrote to memory of 1800 2488 cmd.exe 32 PID 1800 wrote to memory of 2776 1800 rundll32.exe 33 PID 1800 wrote to memory of 2776 1800 rundll32.exe 33 PID 1800 wrote to memory of 2776 1800 rundll32.exe 33 PID 1800 wrote to memory of 2776 1800 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\apt\sources.list1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\apt\sources.list2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\apt\sources.list"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2776
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5c6637ab7e24adbc689de4c15bf8bf271
SHA1e9c719b37b76924940dfd367fec0043cb3a94631
SHA25683df282b9826624c31a3b92f6c6ef9ae4a85c12ac1a97e6df2ad207589cb47d7
SHA512f52174d0b10524e6d582d516f1fe835bcaa4696a893b2db9989b2a1c891f66d1c6b5f71bfb6aff9c61da95520e6b4ab487e1b2836b89c4c8aaa60322d787563f