Analysis
-
max time kernel
119s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 20:17
Static task
static1
Behavioral task
behavioral1
Sample
.sh
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
.sh
Resource
win10v2004-20241007-en
General
-
Target
.sh
-
Size
40B
-
MD5
37d4ae19c5c206383cf5503350b447a2
-
SHA1
9ed7c3dc529b2a6504a900982ae7c21c73517ad9
-
SHA256
b40d9d5622c15644509d9685824abe37abda9428624c63560b058d4fbdb87848
-
SHA512
2d78d3af4637751e6bef524a836045b0b4d121faebbf03e9180eb102e7185964739c3849cde6709ddf298fa0c20432d2fbf473dc2d83be7123a7d247cdd673eb
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2628 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2628 AcroRd32.exe 2628 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2716 wrote to memory of 2608 2716 cmd.exe 31 PID 2716 wrote to memory of 2608 2716 cmd.exe 31 PID 2716 wrote to memory of 2608 2716 cmd.exe 31 PID 2608 wrote to memory of 2628 2608 rundll32.exe 32 PID 2608 wrote to memory of 2628 2608 rundll32.exe 32 PID 2608 wrote to memory of 2628 2608 rundll32.exe 32 PID 2608 wrote to memory of 2628 2608 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\.sh1⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\.sh2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\.sh"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2628
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5544b6fccc9d8cd2ea19e422452229d6d
SHA165e4221d9a48180c186e7c6f57a9be29334d729e
SHA256ec6593c2a53cb5757914664cbba30310cafc70d99a4571e0e213dc76353a72ed
SHA5128e38be02f62eb6d798f0904d6a429095cb9e8dc20c07a1d2795abaf3d515d15576de5637de7e7cf8d02017ee0ea0e62843de9f5f15785e00095820fc5e72bc0b