371edb664c31555dac5e695b0f7286115dd94b380c188948bde2f167f030a7d3

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mercurial Grabber.v1.03/Mercurial/Properties/Settings.Designer.cs
Size

1KB
MD5

849a2a87e6d7c14ffcf27c7b89c1a644
SHA1

9252aa0ea9fae2806d70f9b5d1770cb82ece5dbf
SHA256

9bca1f94e727e3c5137743246d4db53c32844bbf48f19ccc4a35baa5dea2dafd
SHA512

6b6b0c35ffdbf17a5722ffa9e9e35cf8dd84254725c1fe5b3e7f196100a38a71f23fb1668e9b336afa8de4b0c6c5116687d5fe8e76520587837cc1e9bbf59770

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.cs	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.cs\ = "cs_auto_file"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\cs_auto_file\shell\Read\command	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\cs_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\cs_auto_file	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\cs_auto_file\	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\cs_auto_file\shell\Read	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\cs_auto_file\shell	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
3008	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3008	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3008	AcroRd32.exe
3008	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 3008	2052	cmd.exe	32
PID 2052 wrote to memory of 3008	2052	cmd.exe	32
PID 2052 wrote to memory of 3008	2052	cmd.exe	32
PID 2052 wrote to memory of 3008	2052	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Mercurial Grabber.v1.03\Mercurial\Properties\Settings.Designer.cs"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Mercurial Grabber.v1.03\Mercurial\Properties\Settings.Designer.cs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
53927c1b84c1a0acec41256d8bde2bd9

SHA1
d07eb838dcf9e6c30273b84889c03606c097d808

SHA256
f92d4750b3ea168c48ecc7842023bf16976e40a36acca8f199bbfeb9e284d607

SHA512
ca5e9b92f3dc17725dee68e5c3b300a4386f73f68d80f68a6e3d510edbde8d273dd0fa6f815d83bb3967d76ea7feaecf4d3668104d176ba87d655243795f83b7

Download Submit