55e90e18b443a15116c1102dd21397fd1c7dd1e9aff347e1267c27032e3e4bb3

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/bash_encryptor.sh
Size

2KB
MD5

27be323f0057b258961da949655deaec
SHA1

05d60c843a5b85cc51799d638cfaad2b4009dbf9
SHA256

122d4473f8336fa9b3e69d3fb58112b22e7efd9435f53f90d06f9cf8a1dbccc1
SHA512

98a48ae25952ec165b3d99516f67948062b2810ff43d993d33f7c2770c78b5739547208c2003d1b6e53d7fdb4212361f202fbfee49e8546c60e55a40a2d3e758

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2704	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2704	AcroRd32.exe
2704	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2636	2148	cmd.exe	32
PID 2148 wrote to memory of 2636	2148	cmd.exe	32
PID 2148 wrote to memory of 2636	2148	cmd.exe	32
PID 2636 wrote to memory of 2704	2636	rundll32.exe	33
PID 2636 wrote to memory of 2704	2636	rundll32.exe	33
PID 2636 wrote to memory of 2704	2636	rundll32.exe	33
PID 2636 wrote to memory of 2704	2636	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\31.214.157.40_#DarkRadiation_by_@r3dbU7z\api\bash_encryptor.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\31.214.157.40_#DarkRadiation_by_@r3dbU7z\api\bash_encryptor.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\31.214.157.40_#DarkRadiation_by_@r3dbU7z\api\bash_encryptor.sh"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fa868e16f0b8ed05dd6151ff4bf4a3a9

SHA1
fa3822f1118c9f64023ec82616d1c4eeb5f91bda

SHA256
bc2484dd48d4c40083902f6bb5592eff0aca2fc515026404df679caa5caf7894

SHA512
0047d34181eed34c419d14056f77d7fca747169cb81c2894cb8ddc923900c73bc8871dc469e3b276e757883b8461465209d203d83843bd6c00dd7ba979508f9a

Download Submit