Overview
overview
8Static
static
1Cert.zip
windows7-x64
1Cert.zip
windows10-2004-x64
1Cert/.bash_history
windows7-x64
3Cert/.bash_history
windows10-2004-x64
3Cert/.bash_logout
windows7-x64
3Cert/.bash_logout
windows10-2004-x64
3Cert/.bashrc
windows7-x64
3Cert/.bashrc
windows10-2004-x64
3Cert/.profile
windows7-x64
3Cert/.profile
windows10-2004-x64
3Cert/AAA C...es.crt
windows7-x64
1Cert/AAA C...es.crt
windows10-2004-x64
1Cert/AC RA...OS.crt
windows7-x64
1Cert/AC RA...OS.crt
windows10-2004-x64
1Cert/AC RA...CM.crt
windows7-x64
1Cert/AC RA...CM.crt
windows10-2004-x64
1Cert/ACCVRAIZ1.crt
windows7-x64
8Cert/ACCVRAIZ1.crt
windows10-2004-x64
8Cert/ANF S...CA.crt
windows7-x64
1Cert/ANF S...CA.crt
windows10-2004-x64
1Cert/Actal...CA.crt
windows7-x64
1Cert/Actal...CA.crt
windows10-2004-x64
1Cert/Affir...al.crt
windows7-x64
1Cert/Affir...al.crt
windows10-2004-x64
1Cert/Affir...ng.crt
windows7-x64
1Cert/Affir...ng.crt
windows10-2004-x64
1Cert/Affir...CC.crt
windows7-x64
1Cert/Affir...CC.crt
windows10-2004-x64
1Cert/Affir...um.crt
windows7-x64
1Cert/Affir...um.crt
windows10-2004-x64
1Cert/Amazo... 1.crt
windows7-x64
1Cert/Amazo... 1.crt
windows10-2004-x64
1Resubmissions
20-09-2024 04:02
240920-els9raxhrn 120-09-2024 03:58
240920-ejgsyaxgql 120-09-2024 03:52
240920-efgc1axbng 820-09-2024 03:48
240920-ec8m3sxejn 820-09-2024 03:44
240920-eaks8swhke 8Analysis
-
max time kernel
103s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-09-2024 03:44
Static task
static1
Behavioral task
behavioral1
Sample
Cert.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Cert.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Cert/.bash_history
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Cert/.bash_history
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Cert/.bash_logout
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Cert/.bash_logout
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Cert/.bashrc
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Cert/.bashrc
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Cert/.profile
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Cert/.profile
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Cert/AAA Certificate Services.crt
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Cert/AAA Certificate Services.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Cert/AC RAIZ FNMT-RCM SERVIDORES SEGUROS.crt
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Cert/AC RAIZ FNMT-RCM SERVIDORES SEGUROS.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Cert/AC RAIZ FNMT-RCM.crt
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Cert/AC RAIZ FNMT-RCM.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Cert/ACCVRAIZ1.crt
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
Cert/ACCVRAIZ1.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Cert/ANF Secure Server Root CA.crt
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Cert/ANF Secure Server Root CA.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Cert/Actalis Authentication Root CA.crt
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
Cert/Actalis Authentication Root CA.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Cert/AffirmTrust Commercial.crt
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Cert/AffirmTrust Commercial.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Cert/AffirmTrust Networking.crt
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Cert/AffirmTrust Networking.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Cert/AffirmTrust Premium ECC.crt
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Cert/AffirmTrust Premium ECC.crt
Resource
win10v2004-20240910-en
Behavioral task
behavioral29
Sample
Cert/AffirmTrust Premium.crt
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Cert/AffirmTrust Premium.crt
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Cert/Amazon Root CA 1.crt
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Cert/Amazon Root CA 1.crt
Resource
win10v2004-20240802-en
General
-
Target
Cert/.bash_logout
-
Size
220B
-
MD5
22bfb8c1dd94b5f3813a2b25da67463f
-
SHA1
dc216ac4a4c232815731979db6e494f315b507dd
-
SHA256
26882b79471c25f945c970f8233d8ce29d54e9d5eedcd2884f88affa84a18f56
-
SHA512
c3d739f4934824d81f561c9b626b494e3c256b5a97642667882632db030fc1a8c7d23eb1ae5db7e9f63ae46ee84dbee69d15130dd1482a2c1e8aade1dfc545a2
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\bash_logout_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\bash_logout_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\bash_logout_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\bash_logout_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\bash_logout_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.bash_logout rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.bash_logout\ = "bash_logout_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\bash_logout_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2712 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2712 AcroRd32.exe 2712 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2792 2260 cmd.exe 30 PID 2260 wrote to memory of 2792 2260 cmd.exe 30 PID 2260 wrote to memory of 2792 2260 cmd.exe 30 PID 2792 wrote to memory of 2712 2792 rundll32.exe 31 PID 2792 wrote to memory of 2712 2792 rundll32.exe 31 PID 2792 wrote to memory of 2712 2792 rundll32.exe 31 PID 2792 wrote to memory of 2712 2792 rundll32.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Cert\.bash_logout1⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Cert\.bash_logout2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Cert\.bash_logout"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2712
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5818da1af2acb827e9608e03cb7d407d7
SHA11deec64ede89979b1a2960e56bbbe843a0be763b
SHA256a89967b00dca36be28d1b1ae5420ed405f9b35eab65050f0025cce32e17d4ba9
SHA512e1cf37404ecdf9face82746053bf5c195646e76f78636b6ec186560a53dd7d672cdcf07d761f0c96b52d13f66e4feba54b4d7d217ce92e7a697b55cf89894d8d