b653631708cdf4b2ec872b4dca10f3c23380c7a2b2029e20f23b590602d1bcfe

max time kernel
242s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05-07-2023 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

animations/lf30_editor_cjab5ej6.json
Size

41KB
MD5

891d8d9d1b99cc444ef159c72349097d
SHA1

493be2f3109c01243280c72893b21dba695871d1
SHA256

32f0f87470de304b244a7a87971466824a597b4433eed9fb193fc2063a9256df
SHA512

366524565d0c5e5fa53af454de2b17a2690b838fe8cbb908eabdad5c19915ab466c05bb9cd2ae113303bd453266e932b8089131b4274cb01138ad6b48c9c2b1e
SSDEEP

384:jGZC6H4WCtUBvnz0uCZd7OzGZC6H4WCtUrnz0uCZda/T3SVv/k/NBsM6jt+DVpv1:jzfHpczfxpYkIUk

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
560	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
560	AcroRd32.exe
560	AcroRd32.exe
560	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2908	3008	cmd.exe	29
PID 3008 wrote to memory of 2908	3008	cmd.exe	29
PID 3008 wrote to memory of 2908	3008	cmd.exe	29
PID 2908 wrote to memory of 560	2908	rundll32.exe	30
PID 2908 wrote to memory of 560	2908	rundll32.exe	30
PID 2908 wrote to memory of 560	2908	rundll32.exe	30
PID 2908 wrote to memory of 560	2908	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\animations\lf30_editor_cjab5ej6.json
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\animations\lf30_editor_cjab5ej6.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\animations\lf30_editor_cjab5ej6.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f1905ab77223cf552e93322b4a715b2c

SHA1
73045ba5e43e9743f576c446eaf553dd97d5f317

SHA256
ff6174b767d9e738606ce3be95aea7ba7e9163dceaafebdbdb1a34073d1014ab

SHA512
816070e71f1aca2ea5009f5eeb0d2907d8cdf184c7ad34e0729a7b7309d7832279a01a5f863926b7869ef9e6cf9ee16a02598581bb885f8e0b3daab790d14ffa

Download Submit

Resubmissions

Analysis