d80a9a9e404ec34c08563904db3f7ded0836f2f68a1e8000b92bdfbe27674348

Analysis

max time kernel
65s
max time network
18s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21/07/2023, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

manifest.json
Size

137B
MD5

d4707d39b8f77c25e2c06c1caec9a843
SHA1

5550ee82cdbdc709f255fc6b63f5abd02ca6dd5c
SHA256

2b6d2d0d28a8956f71a0c6be7f4c00e0d4d1581689c42844083dad7bb18771b0
SHA512

2e73af3b82310a957110f11a5577f3c0e1427be3f4e3b7348d51111115d1b7c949f57dd3ced6be1c05bb801211214f975d6592dbafd32cf82c667c6408929546

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.json	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2472	AcroRd32.exe
2472	AcroRd32.exe
2472	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2568	2584	cmd.exe	29
PID 2584 wrote to memory of 2568	2584	cmd.exe	29
PID 2584 wrote to memory of 2568	2584	cmd.exe	29
PID 2568 wrote to memory of 2472	2568	rundll32.exe	30
PID 2568 wrote to memory of 2472	2568	rundll32.exe	30
PID 2568 wrote to memory of 2472	2568	rundll32.exe	30
PID 2568 wrote to memory of 2472	2568	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\manifest.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\manifest.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\manifest.json"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3d00df9d164c75ca85804edfec9ece5d

SHA1
919365faa239ec709f3cbb70e4addec0574c0fd7

SHA256
77f795da31b7f62cd970ab8722405492cc2c0cb1fe49d088e6db9e2bf8c82eff

SHA512
66fef7aadd6894c451eb96acf60703399dac84e9603a105f329044a7116a74647dd4191334a632e65d43b7b9b5915f04752b5e0c140c8baea859646834a1fc79

Download Submit