a3807794c390acc037b4de2d88f9869406ec661946af0a9e4a06cbe1ee0ba4a5

Analysis

max time kernel
160s
max time network
35s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30-06-2023 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03_Ari_Dcast.json
Size

1KB
MD5

7c738183cd6a8bcd56badf346ef91097
SHA1

98e5ee6ce61968c06cb4c44ad3b444515a9cc835
SHA256

d7b24603d981df87851b8699ee7a1cc75284fa759530fcc62d62c3c974117ea6
SHA512

509b733d0bbeba4ef3ba77428325618bf132747889c95b1d48fb8d57ab370fad72f343cf840b1033fc6efc651e27b38af1a8d0d63aafd4f6c319f7db10ec397d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000_CLASSES\json_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2012	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2012	AcroRd32.exe
2012	AcroRd32.exe
2012	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 904	1172	cmd.exe	29
PID 1172 wrote to memory of 904	1172	cmd.exe	29
PID 1172 wrote to memory of 904	1172	cmd.exe	29
PID 904 wrote to memory of 2012	904	rundll32.exe	30
PID 904 wrote to memory of 2012	904	rundll32.exe	30
PID 904 wrote to memory of 2012	904	rundll32.exe	30
PID 904 wrote to memory of 2012	904	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\03_Ari_Dcast.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\03_Ari_Dcast.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\03_Ari_Dcast.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c45559b0c5701f4e5e2cad792c5b4ef5

SHA1
81086712756885a773aeea83e0db024d15d15e3c

SHA256
ac6435fc5bc19f461c507e11620839d1d2deceb1cbc10fd353d569448e72aafc

SHA512
cb0b7dc6a1016f133680f424976fb304da98bdf85bd2f9b095da9ab77884120affce2e7d2ffaf09fd7f9f4ea727f4bd306b3ca61a627b6612055f70bf97737de

Download Submit