9b3edc31ba83011b3bbfd67f4217ca6867fb82f455d079bcc69c2e6851e31cf7

Analysis

max time kernel
151s
max time network
33s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
06/07/2023, 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Blank-Grabber-main/Blank Grabber/Components/config.json
Size

900B
MD5

696b3bb3810f490f3948d04b2a1acfce
SHA1

37fb51b2d59eea4744707b853305fe6e5044dd07
SHA256

3ab2dc649b1c3118ea58301cfb1fdc304cd5f4e845931eced42783eadbcac30a
SHA512

f583bf09134fb32d366340883b54c54470e78cfa1b3c03cf4b9d35571855e16dfab449cfef6af1a3a164aa6d7647416a35cad18afa40b405612903abdf1d0d62

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2888	AcroRd32.exe
2888	AcroRd32.exe
2888	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2056	2348	cmd.exe	29
PID 2348 wrote to memory of 2056	2348	cmd.exe	29
PID 2348 wrote to memory of 2056	2348	cmd.exe	29
PID 2056 wrote to memory of 2888	2056	rundll32.exe	30
PID 2056 wrote to memory of 2888	2056	rundll32.exe	30
PID 2056 wrote to memory of 2888	2056	rundll32.exe	30
PID 2056 wrote to memory of 2888	2056	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\Components\config.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\Components\config.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\Components\config.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
aea5bd6a317fd9e5dd0771bf12bbc4a6

SHA1
56aecad88f90f2d4a5a6b470ca114258375bd138

SHA256
10718c367b8f81b1b9f0e01e908e854ef04179a83c70b978e76ca70fa1cbcfd3

SHA512
254706cc94f7074d8e0603483df608d99f1dfef1ce0d58f53e20b614461525627f9e1e86ff6025b4965acd5b7368c1b79d55bb21152a6ac8c0a5c551d8097ce1

Download Submit