Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 11:44
Static task
static1
Behavioral task
behavioral1
Sample
wordbomb-cheat-main.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
wordbomb-cheat-main.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
wordbomb-cheat-main/README.md
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
wordbomb-cheat-main/README.md
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
wordbomb-cheat-main/script.lua
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
wordbomb-cheat-main/script.lua
Resource
win10v2004-20240802-en
General
-
Target
wordbomb-cheat-main/README.md
-
Size
277B
-
MD5
297466e784da46d97f68bf8c66a5d291
-
SHA1
781a394cf129821fc774267e44deff85d4ac84d4
-
SHA256
f70686573794512d12a1bce8bf6fbc9482ebaf772326a25154b7b51a90b884bb
-
SHA512
19bf85706c4f96771ccfd9ab4a36c1bbde0915c876a1ff97b3f95f842e50d208088961c6ac5046e9ad56cd0fc4a6a699c3b6e93429f6ac754fb2d803e488cd40
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\md_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\md_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.md rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\md_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\md_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\md_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.md\ = "md_auto_file" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2556 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2556 AcroRd32.exe 2556 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2740 2764 cmd.exe 31 PID 2764 wrote to memory of 2740 2764 cmd.exe 31 PID 2764 wrote to memory of 2740 2764 cmd.exe 31 PID 2740 wrote to memory of 2556 2740 rundll32.exe 32 PID 2740 wrote to memory of 2556 2740 rundll32.exe 32 PID 2740 wrote to memory of 2556 2740 rundll32.exe 32 PID 2740 wrote to memory of 2556 2740 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\wordbomb-cheat-main\README.md1⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\wordbomb-cheat-main\README.md2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\wordbomb-cheat-main\README.md"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2556
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5c0247c975413f38fc07ced530fcf13d5
SHA1c7e94f030fbf1b19484772d797d44d62ee558c94
SHA2561abaec7454cefc9cc8dc9e031d236154a7ee747326757c349de126600e91033f
SHA51227c891a27d5056701c8a9e160385432fe3e29bb18287b8b651ad6845c183ee1d982a505e42b3ba13fcf0e5687329c7c012380df5990d3b04acc60b0b4276b54a