66a32b79ff2c15ac32dd147b9509c1d0b8fb0e24f91f478352fb9564d45416f8

Resubmissions

06-08-2023 19:58

230806-yps8psde2y 7

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06-08-2023 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01_FormAppearance.json
Size

2KB
MD5

b3a51c4b4e79266232efc89ea7794a3d
SHA1

6efe88afa92f72e9b0902ca0ec175a1b6c10a194
SHA256

4ac103dfbcbdf7bc260e6f1ecae6d51b8568b527a72c3089df6e4698186e9869
SHA512

4eaeb2a7bead275be983e4b7d17cfedca9d816de93ae82b067ab35e140019603f1ea4f14d55a9034c288aefb816457f82628f17db41b9c72ce28b07b5df021ea

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\json_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1556	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1556	AcroRd32.exe
1556	AcroRd32.exe
1556	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1972	2220	cmd.exe	29
PID 2220 wrote to memory of 1972	2220	cmd.exe	29
PID 2220 wrote to memory of 1972	2220	cmd.exe	29
PID 1972 wrote to memory of 1556	1972	rundll32.exe	30
PID 1972 wrote to memory of 1556	1972	rundll32.exe	30
PID 1972 wrote to memory of 1556	1972	rundll32.exe	30
PID 1972 wrote to memory of 1556	1972	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\01_FormAppearance.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\01_FormAppearance.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\01_FormAppearance.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
aa51613fa0b61926ad8d7b51f96df187

SHA1
33bdf028a54777a83a90a72e91ce3de744c6d179

SHA256
bfa7e78fe08f62a99e2eac0cadff3dd4075c3743a9ad76368544fd881aa22e70

SHA512
2b981375e640d1674680dad981e08a569a9dd579238bbb911298f319e6e0a28b8d9eb7ddfc0a85c6fa00942c2c3f6d7988d1673e08ec934197e6a4dac139433f

Download Submit