dbaca2fe280af72be7c98d3cff7fc4e9c5899fa2845bb6eba58cb6931d170d4e

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wang-bin-QtAV-f672e4a/config.tests/gentest.sh
Size

627B
MD5

199fc7ecf12a5503eaf4174eafce8695
SHA1

579dbc4ef97786afb933766d07bb46bb60243992
SHA256

e0a532bfa5a88857b345d61cb85cb6288dd7e404bf14a260f056328a257bb02b
SHA512

d4aa1cae58f4434387ecf3f5dd3326f45507adb08f2b57c79eaa6a2e589e0d9db542258c2ac4d0f9ee622238a2c952cad36c1e898de066ba8776132c7fd93742

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.sh	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\sh_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\sh_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\sh_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\sh_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\sh_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.sh\ = "sh_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2836	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2836	AcroRd32.exe
2836	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2844	2352	cmd.exe	31
PID 2352 wrote to memory of 2844	2352	cmd.exe	31
PID 2352 wrote to memory of 2844	2352	cmd.exe	31
PID 2844 wrote to memory of 2836	2844	rundll32.exe	32
PID 2844 wrote to memory of 2836	2844	rundll32.exe	32
PID 2844 wrote to memory of 2836	2844	rundll32.exe	32
PID 2844 wrote to memory of 2836	2844	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\wang-bin-QtAV-f672e4a\config.tests\gentest.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\wang-bin-QtAV-f672e4a\config.tests\gentest.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\wang-bin-QtAV-f672e4a\config.tests\gentest.sh"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9d3b9cc6383ab0d882a3337d4c0afc92

SHA1
d1ac47ef154673c3a6ddb22e7de4cd60f5b197d7

SHA256
5af899e0b1cddd98831c7af76b0ab5017c81081c97cd23626e3037b5385b6c96

SHA512
ea0999c098674e0a475da33e9125c1e03b5fcdb50cdf5afe3d4e3d1958c27be5f3103faea9b095be48e1b40988bba3aa1e112d6c6fabe3beea4ab59a05f850ce

Download Submit