b2ec54685b1596259320fe92f11cb2f081372b6d80676ba95f278b03ad12493a

Resubmissions

04/10/2024, 18:21

241004-wzbqasyfkp 6

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 18:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

lunar-client-qt-2.0.0/config.json
Size

137B
MD5

a8dded26d395094a0aadb2b167cf736b
SHA1

10bb1344994b0ec74806cd391ac11b7fe667db81
SHA256

daed8f696e1c71ad5a95487243ba345a89c63f0d4eea478ca42233a04659f45d
SHA512

2b7bf8baa6287c86a8a371dd6abd430c0c5c7668f8e9106d43704e94f579289c17092ed0998a14c8f6ee1d6354b394573288aa7c45f72cc03b0406dc7c40234a

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2636	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2636	AcroRd32.exe
2636	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 876	2096	cmd.exe	32
PID 2096 wrote to memory of 876	2096	cmd.exe	32
PID 2096 wrote to memory of 876	2096	cmd.exe	32
PID 876 wrote to memory of 2636	876	rundll32.exe	33
PID 876 wrote to memory of 2636	876	rundll32.exe	33
PID 876 wrote to memory of 2636	876	rundll32.exe	33
PID 876 wrote to memory of 2636	876	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lunar-client-qt-2.0.0\config.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\lunar-client-qt-2.0.0\config.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\lunar-client-qt-2.0.0\config.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a4029033fa3e33b366a1b62a631bd9c4

SHA1
6bcc39e3b9f439c79c999009625023aee1e8b3cc

SHA256
ec57eb2cf8d5de42b821f5217bbe25f09888fcd282211b558b23287374de800e

SHA512
ecd147ea74bde4ac602128fba1e905013ee7a906ad8c0f0684413f4d53385dbecd9219740a55bc33db0c7e6448f7bc4d5fbc6317f0230592f603d15031ecaa9e

Download Submit