2b86d881171d2c4605294f2482a01c12cb93555511e7762b36398e6893ef0eb9

Analysis

max time kernel
152s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
18/09/2023, 09:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

UnityServicesProjectConfiguration.json
Size

864B
MD5

a3ae25b293cb0d83940510d3a7a25113
SHA1

60fbca80eb128270a0ec10856b56169423511a4b
SHA256

e2d233597da5594e1e851f8edf267743fbd452e4c1b13e4378ec37e8af33fcc7
SHA512

6bd23ff139f835907c5fb400c96ad7366d14d929b0d1f829565a8e0acc10bad1edcf8fd4666ed63d5f5574ed1f9bab7f9409fdad5c067cf2fe34afcd5096e878

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\json_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2664	AcroRd32.exe
2664	AcroRd32.exe
2664	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2616	1584	cmd.exe	29
PID 1584 wrote to memory of 2616	1584	cmd.exe	29
PID 1584 wrote to memory of 2616	1584	cmd.exe	29
PID 2616 wrote to memory of 2664	2616	rundll32.exe	30
PID 2616 wrote to memory of 2664	2616	rundll32.exe	30
PID 2616 wrote to memory of 2664	2616	rundll32.exe	30
PID 2616 wrote to memory of 2664	2616	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\UnityServicesProjectConfiguration.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\UnityServicesProjectConfiguration.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\UnityServicesProjectConfiguration.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1bebc6bf5af16ff767c8ba167de73569

SHA1
d99fd91b134f81c56eedb464874119bd670216d8

SHA256
ce498326fd3c4ce82acc94d8a14f99ab66f6f6690b27c93ed828e56ab3c8857b

SHA512
c44ab8f430944dde2626674575dbf95679e224769353dc377c19d25e3fc884708779deb1395119cee5bbd92ba2080ff31fe99917aef84cc4969490539518a684

Download Submit