f5705d808d9f833f4de7d590d139b5e8b0d93af7be3231ac2d2124c305766bab

Analysis

max time kernel
840s
max time network
841s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
08/03/2025, 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dolphSol-Macro-1.4.0/.gitignore
Size

31B
MD5

2d930d7a52be4103684fb480bf72c973
SHA1

d19064239269b0e2ae302bda2b809d7caaca34ca
SHA256

8c25502af1b3fc2e33e9d1b9b263158671fee745a74af5f9d1fcb8cbb488d3c8
SHA512

775e758d0ede6386807d5a1587077ee3e684bb8744eec4154c7fb606f34ae1283e9136c3f5ce3e524faa6dab69dc862ce00b3756e566fd461821f35062b0644b

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2768	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2768	AcroRd32.exe
2768	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2596	1724	cmd.exe	31
PID 1724 wrote to memory of 2596	1724	cmd.exe	31
PID 1724 wrote to memory of 2596	1724	cmd.exe	31
PID 2596 wrote to memory of 2768	2596	rundll32.exe	33
PID 2596 wrote to memory of 2768	2596	rundll32.exe	33
PID 2596 wrote to memory of 2768	2596	rundll32.exe	33
PID 2596 wrote to memory of 2768	2596	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dolphSol-Macro-1.4.0\.gitignore
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\dolphSol-Macro-1.4.0\.gitignore
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dolphSol-Macro-1.4.0\.gitignore"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
715a51ed01b6f12611a6aaf432472cbc

SHA1
eccfc29d5d9e10074ed83fa63b2e47a054cb6e72

SHA256
adb8d3e9990e0d194303fc773dd1ca1856d9e1e3b191779238dffecedfc324ab

SHA512
0c4bacca1bbe52a1cc78977f68734a320cab9e2119a15e3a04c7ef791074fd1ba918597dcb886e798202a98ee56185aa7186a9e1267b86697def92805ee35835

Download Submit