3df8c6397421ca385bf7a48e87e5c9c90ddb922b6abc36443fc4fa7475815f5d

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 10:41

Target

test-Fw-NSN.pl
Size

1024B
MD5

7feec4b8cb54b161be0163caa57e95db
SHA1

5a08ce204f6f2bb9c42aae6f0619518a12cd2b0b
SHA256

0db68ac2f0afe6c6c893644b32b7ac30b597721b540fc1d0e8c56aadde596df4
SHA512

56f536ad37314e573db374c1001e10aa0de4b9d7e90668a24350da49defd193a8f584449a2f27196b409c189f6ae1697ba38192cf1a98a974876fd583f54bb2a

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\pl_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\pl_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\pl_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\.pl\ = "pl_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\pl_auto_file\shell\edit	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\pl_auto_file\shell\edit\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\pl_auto_file\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\pl_auto_file\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\pl_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\.pl	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\pl_auto_file\shell	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 536	2096	cmd.exe	31
PID 2096 wrote to memory of 536	2096	cmd.exe	31
PID 2096 wrote to memory of 536	2096	cmd.exe	31
PID 536 wrote to memory of 2928	536	rundll32.exe	33
PID 536 wrote to memory of 2928	536	rundll32.exe	33
PID 536 wrote to memory of 2928	536	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\test-Fw-NSN.pl
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\test-Fw-NSN.pl
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\test-Fw-NSN.pl
    3⤵
    PID:2928

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact