2ca4803498d7d375a61bfab2a3a4cf7e0eec41d116e50a838791a55b164e0f8c

Resubmissions

13-01-2025 04:35

250113-e7x5tswlfz 10

13-01-2025 03:52

250113-ee43nsvjby 10

12-01-2025 15:57

250112-tealdsymgt 10

12-01-2025 15:53

250112-tbnc3s1mhn 10

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware-1-master/readme.md
Size

154B
MD5

663c882a0d419faf6e2f5248475af539
SHA1

16aa09ad953d6c1f9b119db699518cefac07a937
SHA256

778853b036941d503d6f279777eeb14130c24c318e5c2ea2c6eadabca331693b
SHA512

97a0db4705846772765d497f59200dc47f96c167aba886e61292eaa19d2c798923022572a1da755a926ebe4832530e870714f31281329d0f76833569415f111e

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2664	AcroRd32.exe
2664	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2668	2120	cmd.exe	31
PID 2120 wrote to memory of 2668	2120	cmd.exe	31
PID 2120 wrote to memory of 2668	2120	cmd.exe	31
PID 2668 wrote to memory of 2664	2668	rundll32.exe	32
PID 2668 wrote to memory of 2664	2668	rundll32.exe	32
PID 2668 wrote to memory of 2664	2668	rundll32.exe	32
PID 2668 wrote to memory of 2664	2668	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Malware-1-master\readme.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Malware-1-master\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\README.md"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
da464d168f6b287ddf543e640f231445

SHA1
eb02a1c43de880c1dbed54dd292fcb348209677a

SHA256
0171363d71ea6f086a4d22581c4b7601d33d50c4527ac5672785c2de1ee584a0

SHA512
8a020c7ce59970e1fe510c9af81f2e47a19a7849682135e6d98058197a97964839ff1ff144ee0536d7d61710e787882af122ce6bb1d54135ae573cec2c91914a

Download Submit