bbcc6444202f68e4154063fe28d7a5bd1dde6de140b7e80d707060bb7dbe1650

Analysis

max time kernel
156s
max time network
146s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/07/2023, 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Among Us v2022.12.14i-Pivigames.blog/Among Us_Data/RuntimeInitializeOnLoads.json
Size

2KB
MD5

fcee094b00ec07b388f5d36af640181f
SHA1

dfac6e01e69d482c79967d8c0da371182dccd3e9
SHA256

ea10213af74e1f5ec1491e0605c66b1a8710f485e3a790e1488cc607a8715d66
SHA512

1278eadffe2800c1de42715d4e3585cd629195068e4899aabb4f02c64621f2988446a0ca5378225cbff92536ce5e2b422b109c4ab9cec92b29e91fe6504646f8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2836	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2836	AcroRd32.exe
2836	AcroRd32.exe
2836	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2900	1292	cmd.exe	31
PID 1292 wrote to memory of 2900	1292	cmd.exe	31
PID 1292 wrote to memory of 2900	1292	cmd.exe	31
PID 2900 wrote to memory of 2836	2900	rundll32.exe	32
PID 2900 wrote to memory of 2836	2900	rundll32.exe	32
PID 2900 wrote to memory of 2836	2900	rundll32.exe	32
PID 2900 wrote to memory of 2836	2900	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\RuntimeInitializeOnLoads.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\RuntimeInitializeOnLoads.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\RuntimeInitializeOnLoads.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2236868486ffb8d7e7c09ba816729030

SHA1
7e3f811dcd2a3660e5b96d30a2847b95cb0d0229

SHA256
893ee991e08708a53960eb52ad225e29fc10c9a7451e08f8f5c81b6b49d860ec

SHA512
a8ad64d1f55079203b6746be4843bc0b64cdf756853a7e20625af7531cdb34a8dfc7466482a5c15caaa381d8144deaafa66789c77ca0d21e697597fa1bbdb81e

Download Submit