4e5eb312beb422b2683368e2d5e9f3006028b492373107139008d84ff68d55e2

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
15/11/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
z.sh
Size 3KB
Sample241115-e6jaaayhlc
SHA256 4e5eb312beb422b2683368e2d5e9f3006028b492373107139008d84ff68d55e2
MD5 1a0e4ab2d2823547ef0603cd900d618a
SHA1 a263e2e109cf04a32f96dad1237d48ceb13715e9
SHA512 7a5f7b72d07f1982568d17b28ed9ca2519fdf905d6b0638e02ca9704a2e617e347324a4c2ed4b4f3e3b72270d4b0145ee43c921384acfb343d8a63a01505654b
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2888	AcroRd32.exe
2888	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2500	2604	cmd.exe	31
PID 2604 wrote to memory of 2500	2604	cmd.exe	31
PID 2604 wrote to memory of 2500	2604	cmd.exe	31
PID 2500 wrote to memory of 2888	2500	rundll32.exe	32
PID 2500 wrote to memory of 2888	2500	rundll32.exe	32
PID 2500 wrote to memory of 2888	2500	rundll32.exe	32
PID 2500 wrote to memory of 2888	2500	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\z.sh
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\z.sh
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\z.sh"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 b92c27739fdd8904f33ecbdb4148ed17d4f1cf29f1809c3d8aba64b5529a3c4b
MD5 ff3f3f54a45e6aafed91a08181db1a17
SHA1 bcda9e3776814e5bf040d83ae2263f55f611b001
SHA512 f4c4e5c101c1a39390d7b9906fa399b56e9cd2c705b1f7dcf68d8a288b8a92638ed50ebbb36db9b1f922daedbb0acdb8f920a7d4f62d60b0a52b1502a80ea8ee
MD5 SHA1 SHA512

Submit Download