bbcc6444202f68e4154063fe28d7a5bd1dde6de140b7e80d707060bb7dbe1650

Analysis

max time kernel
166s
max time network
152s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/07/2023, 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Among Us v2022.12.14i-Pivigames.blog/Among Us_Data/StreamingAssets/aa/settings.json
Size

3KB
MD5

a29d23e311e0888025453069dc5a46a6
SHA1

f59b7b805c88721f770001470c789a4a090700a8
SHA256

0513b9e2b24bbc7922993fe182a8167388a267ffe8ac09c37907beeea744812f
SHA512

955df2d9ae569b447b4e6dcf92fb594dbe80c9baed369037c9db4e84d9e0c07ba9af2de6e3fe6826ad262a2743b8f795259f5c1207500340533faeb8c42bba3a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2968	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2968	AcroRd32.exe
2968	AcroRd32.exe
2968	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2860	2584	cmd.exe	29
PID 2584 wrote to memory of 2860	2584	cmd.exe	29
PID 2584 wrote to memory of 2860	2584	cmd.exe	29
PID 2860 wrote to memory of 2968	2860	rundll32.exe	30
PID 2860 wrote to memory of 2968	2860	rundll32.exe	30
PID 2860 wrote to memory of 2968	2860	rundll32.exe	30
PID 2860 wrote to memory of 2968	2860	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\aa\settings.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\aa\settings.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\aa\settings.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5b7849004fd89baf5565d0736df9c1b5

SHA1
0a1240b88b43f6836b03310947f9fb546f729598

SHA256
bc6581e8fa69a34ae465184e9dd46d9f59933d1aac048bd29e41c4eb748240ab

SHA512
6b43b1b0825cfb0cacd2703e38cc4271bda6b6d61053698d633c0afd654c06458f956767f03a7b46c3f7c0e3e46c2113121e25ef0382d7f8355d7649349bf067

Download Submit