bbcc6444202f68e4154063fe28d7a5bd1dde6de140b7e80d707060bb7dbe1650

Analysis

max time kernel
162s
max time network
146s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/07/2023, 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Among Us v2022.12.14i-Pivigames.blog/Among Us_Data/StreamingAssets/CustomAssetPacksData.json
Size

137B
MD5

601cadf88bf97643cccde5bfb0ccda39
SHA1

cd97f7930965c49eb10288c20593fdf40f1a0ce9
SHA256

e5eda2692ae02be0f1ce3d669227489fb13ef417c13a6be8e268df7f831a2b14
SHA512

62f31f914038e598b73032aba22acb663a37480c3047a511a4d88ec52ebd0aa4bef4c224e90f576590baaa050093472e5d4e19981e02f9f96902d0b744b8f639

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2916	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2916	AcroRd32.exe
2916	AcroRd32.exe
2916	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2800	1904	cmd.exe	31
PID 1904 wrote to memory of 2800	1904	cmd.exe	31
PID 1904 wrote to memory of 2800	1904	cmd.exe	31
PID 2800 wrote to memory of 2916	2800	rundll32.exe	32
PID 2800 wrote to memory of 2916	2800	rundll32.exe	32
PID 2800 wrote to memory of 2916	2800	rundll32.exe	32
PID 2800 wrote to memory of 2916	2800	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\CustomAssetPacksData.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\CustomAssetPacksData.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\CustomAssetPacksData.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9ba6d29a969df7576ecda15176cae69b

SHA1
29e33822bdc06c709ac27b2aa3db14685ab895e0

SHA256
bc0739198d9c6d8e3cb2033678d94405f0c55b72900b004bba79e693150e0fae

SHA512
afd5eccc56eb6f54c71b61dede4067238a87e4605ea4a6f54ea6b521207b18ca8e47f41ebeda94fcd81af1f8e917218503d03d4c4b0ca267c35bb9c8d919e61a

Download Submit