d169f5cddd7b7d6b45dfed7e9e216a4af93b9738eb2b736362484ee777d76bac

Analysis

max time kernel
163s
max time network
143s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04-09-2023 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ionic-push-notification-android/android/app/build/intermediates/assets/debug/capacitor.plugins.json
Size

650B
MD5

8d1218c7ab48c4774c7217ddde595fa8
SHA1

e51e1f4ece5acdb334e851193583116740c59e3b
SHA256

45b7b59c4835c6131aa1dbd3426a16cbd41efeacf0cd7dad5c3f3cb34d2db7ca
SHA512

2edb5a7de26c872bfd4fb726ffcacba33549b33d96f7f8a321338fb60cf27b743175f8f9ac2f66fd1e037975014a63cd529a2b52cb338c602958dda6754a5f8f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2556	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2556	AcroRd32.exe
2556	AcroRd32.exe
2556	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2244	2828	cmd.exe	29
PID 2828 wrote to memory of 2244	2828	cmd.exe	29
PID 2828 wrote to memory of 2244	2828	cmd.exe	29
PID 2244 wrote to memory of 2556	2244	rundll32.exe	32
PID 2244 wrote to memory of 2556	2244	rundll32.exe	32
PID 2244 wrote to memory of 2556	2244	rundll32.exe	32
PID 2244 wrote to memory of 2556	2244	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ionic-push-notification-android\android\app\build\intermediates\assets\debug\capacitor.plugins.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ionic-push-notification-android\android\app\build\intermediates\assets\debug\capacitor.plugins.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ionic-push-notification-android\android\app\build\intermediates\assets\debug\capacitor.plugins.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a442de9b20105fb47c2299411aec27af

SHA1
e6caaee7db82a4f0761c37be38b50e3bd5de5cbe

SHA256
fdaa9cf725004677bd04dd66d8eb2cc853f8af0da9b2675e426e9753deb5ac6f

SHA512
b7813813428ba686cf40463567758b63fa84564a3242d0a56647f745c7e419345a13df80dd7b84468ec0c53a8390726f4b165076b880d42b6b74a4a02bcd22be

Download Submit