13483dc0f61d29683c45092618e98775462e5f68805de9931a5802b05ddda5fc

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-11-2024 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GrowCastleAutobot-main/.gitignore
Size

479B
MD5

63f938f14302391582ff1cedbe850e0f
SHA1

9cb3ebeae427ebe25831c9c08ed4a04b56e05729
SHA256

742c451c740277e7a181d0b6b05782473699a18e012a78a4d3d6215567df2acc
SHA512

5987d860a064b99d0d6eeafe52fe1514ff204172e6232dfd7c619444cd48ca96072c3bbe097e6690e3236056ca286975550eccb385d2dc8d28c6f5dc0ce11433

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2844	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2844	AcroRd32.exe
2844	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2328	1288	cmd.exe	31
PID 1288 wrote to memory of 2328	1288	cmd.exe	31
PID 1288 wrote to memory of 2328	1288	cmd.exe	31
PID 2328 wrote to memory of 2844	2328	rundll32.exe	32
PID 2328 wrote to memory of 2844	2328	rundll32.exe	32
PID 2328 wrote to memory of 2844	2328	rundll32.exe	32
PID 2328 wrote to memory of 2844	2328	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GrowCastleAutobot-main\.gitignore
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\GrowCastleAutobot-main\.gitignore
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GrowCastleAutobot-main\.gitignore"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
52145ef7f8ff605ac3061a0e66238586

SHA1
ba6a5602b523cedd77aafeea72f0dc48226a480c

SHA256
90f871b45456ea818720ad1a0916f65a4a8b246420e8703ef22fede4343ac2a7

SHA512
60a8000c49b45705c3d5f97aebc7942fb063243bf1b2fc632da623627c699fa499e7649d9d5e0720d57c574e467c0b8efdf520790a8cae198781b8c92cada449

Download Submit