c1d16d4287bff47727b7b5fd82f784fe3767efa49cad3ba49efd792f04eb3228

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VanishRaider-main/README.md
Size

5KB
MD5

4d5001ec0ffe8e980f4613603df49f4a
SHA1

0a1c1a44caae96976ec93d7a021c94034a4e8a24
SHA256

8c382ec5bec1fd5c3e21594583d6ca512e3f5d1e1960264707fd0e46e662cf79
SHA512

b5b899e70cd5292c29e037ffbe48c87443871bb6cfdf334dc757dfe8895cf3440869d596575bde3c7584a4671fb498b01226b45fca95e5790a82e5c5a9eda973
SSDEEP

96:CCke5YaVtGjgWsrYEwP7KlYFqeFnRxkFU7bB8EEE+EB2StaU7HtpxC9v/6W1NWAq:4LaVtGjguBkYTVkUX5sSjNp8nWbN

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\.md	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\md_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\md_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2092	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2092	AcroRd32.exe
2092	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2688	1812	cmd.exe	31
PID 1812 wrote to memory of 2688	1812	cmd.exe	31
PID 1812 wrote to memory of 2688	1812	cmd.exe	31
PID 2688 wrote to memory of 2092	2688	rundll32.exe	32
PID 2688 wrote to memory of 2092	2688	rundll32.exe	32
PID 2688 wrote to memory of 2092	2688	rundll32.exe	32
PID 2688 wrote to memory of 2092	2688	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\VanishRaider-main\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\VanishRaider-main\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\VanishRaider-main\README.md"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
abe4de1b12cc7eb51944b06e51cb9c14

SHA1
481bb389b44ab99edb2ec8c7151b876818799597

SHA256
3df14fd3ba015af60c934c98249305f9bbf974a21dfcc670cc9f8798d69a2f68

SHA512
66dcd5411c66e0302da5b44be6378897cdc72c23179e365aee67cf30443286aa373e25a14fa8272acf95d6d4a7990b33ce243c69964a3a55922a9a260aa2af69

Download Submit