bbcc6444202f68e4154063fe28d7a5bd1dde6de140b7e80d707060bb7dbe1650

Analysis

max time kernel
156s
max time network
43s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/07/2023, 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Among Us v2022.12.14i-Pivigames.blog/Among Us_Data/StreamingAssets/aa/catalog.json
Size

423KB
MD5

be2119f515eae0e6dacf99d9d89247c0
SHA1

84940cb69a08871a6d37acbf29139e4042065f69
SHA256

154dee173c1a59b941b220ba69c3e6fc43928de1bda2afdc1aa5d1912e17d63a
SHA512

c7a5caed82f30a59ec87d8143f92bd0fac0c669e976a11f6ecc50df45ec21dcfe488afb88082130db5b9e5a0ea6696676700876381f0c21660b0e077590a2725
SSDEEP

12288:iqtDnOfLplK0tQ1lr/fF6B+ilqYYfzqjOu:iADnOfLplK0tQ1lr/fF6B+ilqYgW

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\json_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2944	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2944	AcroRd32.exe
2944	AcroRd32.exe
2944	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2912	2320	cmd.exe	31
PID 2320 wrote to memory of 2912	2320	cmd.exe	31
PID 2320 wrote to memory of 2912	2320	cmd.exe	31
PID 2912 wrote to memory of 2944	2912	rundll32.exe	32
PID 2912 wrote to memory of 2944	2912	rundll32.exe	32
PID 2912 wrote to memory of 2944	2912	rundll32.exe	32
PID 2912 wrote to memory of 2944	2912	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\aa\catalog.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\aa\catalog.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\aa\catalog.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2e8cbf99cbfc80b974afdecd3f9da253

SHA1
992b228fa38ba46c9b02ad8a1c88ba4718a8e3d0

SHA256
014a0787750f2c52885b7ca01616d5e5207bea73a6e0b41d192ce5e485e813af

SHA512
9eed5ef5f0847726aaec883cfaa410bdd9500a2a849e9f8a8c63fafa3450e8163bd1092d1679ef2cc4f3e1b6609ab4171b0a75b81cbc6c0cd899d991f7548852

Download Submit