383edf08484ffa453a9826bcc05b707e8e152d3478a62a1fcf8277d971a35718

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06/08/2023, 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nether Client/Nether Client.json
Size

5KB
MD5

3037dfd7d1dcbca350d46b4b40a81c25
SHA1

7895b161f6393217d639926a7789ffab67262ba4
SHA256

5998804f0b676b634ce3a5d8b3d4d17a72180ad5e267f1cce343b54d0352e7a6
SHA512

576ac64dbf90604abb090868579efd3d9222753239cb1a2480d9883358e259e25ef8c17c0871676cc912c9006e84f86c0109d46178611d178e8ddcd90b2050fa
SSDEEP

48:E/82E63w4Q4l0jHEucrQKW3kdtH3NMrd3rCrYzzWntW6WSzRzcOrJzYslF5BL:E0oS4GHVIfWC9gzz4TfzRz1zDlFLL

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2944	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2944	AcroRd32.exe
2944	AcroRd32.exe
2944	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 984	2168	cmd.exe	29
PID 2168 wrote to memory of 984	2168	cmd.exe	29
PID 2168 wrote to memory of 984	2168	cmd.exe	29
PID 984 wrote to memory of 2944	984	rundll32.exe	30
PID 984 wrote to memory of 2944	984	rundll32.exe	30
PID 984 wrote to memory of 2944	984	rundll32.exe	30
PID 984 wrote to memory of 2944	984	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Nether Client\Nether Client.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Nether Client\Nether Client.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Nether Client\Nether Client.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
81b429b8aef4f81a87db1474105d0d6b

SHA1
d690755aeee78f48acda7ca55e7b48ecab20438b

SHA256
1b53bb505dca78a5022427c48480cd69a072bb20e33f42c47186239ecfd4abd2

SHA512
79d6899f59d3df40fa654e17343f1d54c8c5a40f32a6083d8d241484b649010d143b0660364138ed63004ed95ef125d20ff908c13d7a3c60f7ff1ed64322ca2c

Download Submit