8fdbff40ffb8d74aac4a41da26ba2a21d7d5c624b0281fbeaab0a5ea563d113a

Analysis

max time kernel
18s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MasonRootkit-main/README.md
Size

2KB
MD5

53940e8ccff20bc384ad12106bd03bf3
SHA1

469dc9306565c3a418941a88a81784be77fb413c
SHA256

4b324a4edf676d5365197f74199b4dc6278dcdf6e425275dd0b27169d278a157
SHA512

eecc2242fcf81d4fa12385a1bd4a83ba8ac45ce259cf1049d61a3fa111014dc806b129d4e846f3f0d960b65196fd83be58cf9d843dca0488247e684d88812c84

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\md_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2932	AcroRd32.exe
2932	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2760	2384	cmd.exe	31
PID 2384 wrote to memory of 2760	2384	cmd.exe	31
PID 2384 wrote to memory of 2760	2384	cmd.exe	31
PID 2760 wrote to memory of 2932	2760	rundll32.exe	32
PID 2760 wrote to memory of 2932	2760	rundll32.exe	32
PID 2760 wrote to memory of 2932	2760	rundll32.exe	32
PID 2760 wrote to memory of 2932	2760	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MasonRootkit-main\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MasonRootkit-main\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MasonRootkit-main\README.md"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1ff56a279fdd452d5c674dc8b28d1acf

SHA1
f8875e7cb235844ebed83ee0115bbb52d70f2567

SHA256
05a57d64cfee0fdec44474ee9ec81f901620770f022b7721ea47235511ba3e62

SHA512
eb55e0fddb771418c9e406886b61858225df2fba1f14d011416fe72583d8616bdfcc518ff3e86e05bd0955d1f4885a4cd2b78f7ed09ca987f3a5077ead0ac110

Download Submit