f468da34285c74eee812a02dac1fa5b22d84d5b3535a31618d33c644249e1c5d

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14-08-2023 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

assets/part_names.json
Size

27KB
MD5

4bd230633a9d37af573876c125f88a9a
SHA1

2f9ff5d42286277b0230e62e34622c92365e6154
SHA256

0a2e494fc4fb49c137a9a334bb8ddb388402f15bb1ba9db211d96b4cc41466bb
SHA512

eb3ac6584f6865e34b2c478f60982e959eb58c571467b4ec0c1edf3280f5905b4f8c53852228c2749029eb615fcd48db991bed5b1cce4be1064ddcf60a09a736
SSDEEP

384:TfbpMwqg+87TkwTX6Fi8TC9anfqnIWOO5/U0fwKpnTSuA3v9KpimvxTbqlaAOWhc:zbdTX6dTC9+WTyVKnT+aXWSX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3064	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3064	AcroRd32.exe
3064	AcroRd32.exe
3064	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2904	2592	cmd.exe	29
PID 2592 wrote to memory of 2904	2592	cmd.exe	29
PID 2592 wrote to memory of 2904	2592	cmd.exe	29
PID 2904 wrote to memory of 3064	2904	rundll32.exe	30
PID 2904 wrote to memory of 3064	2904	rundll32.exe	30
PID 2904 wrote to memory of 3064	2904	rundll32.exe	30
PID 2904 wrote to memory of 3064	2904	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\part_names.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\assets\part_names.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\assets\part_names.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5c39bbbc907005677cbc919b3aa38fc9

SHA1
40600dcc5c542db06a630a4a9a11c466a4efa5cf

SHA256
d727257189260b71f46a1cf6c33ed14262027fb13e26265bf9a9a1f3f8cb6a56

SHA512
5dc7c549a18092ffc760f2bfe8125cfff011bccc2fe36b74493464dee50bea9ee6d3a4d0c18a8db63b4e04705e831e60b81c2b84251a57f1a35f2afb5acc4dc6

Download Submit