dcbb63002f5b6b4339ce494d3718e6517de650aeb4d3d72a601055f434f84949

Analysis

max time kernel
229s
max time network
192s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_global_variables.json
Size

16KB
MD5

510f40ee0ffaf7f2297f64b83abd895c
SHA1

cf1b43b65b53c3a7881a6aa9bc9639dbb53e3166
SHA256

503fe2d6278feffe58e9b58f35d4c9ae85575d0ca3dfcd2b30e148be9826ac1d
SHA512

222d635e162ea613b090e7f27a3c0705d965131790f31b03696be9f9c6bb082db9fcd0473e1c3f24aee6783138d0803902797fa9d39998952b0981872411f5d8
SSDEEP

192:qkheczgLV5UxWAgBSaNpX9UQs1Ss4lRGWsFYf8vb:EczgLb7NpXjIWsFYf8vb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2996	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1892	AcroRd32.exe
1892	AcroRd32.exe
1892	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2996	3020	cmd.exe	28
PID 3020 wrote to memory of 2996	3020	cmd.exe	28
PID 3020 wrote to memory of 2996	3020	cmd.exe	28
PID 2996 wrote to memory of 1892	2996	rundll32.exe	30
PID 2996 wrote to memory of 1892	2996	rundll32.exe	30
PID 2996 wrote to memory of 1892	2996	rundll32.exe	30
PID 2996 wrote to memory of 1892	2996	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_global_variables.json
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\_global_variables.json
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\_global_variables.json"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b946a5ea109959419548e20eff67ccc3

SHA1
28a035dd779a83fb140bfbef0dc3d2d54a893590

SHA256
85e938beb71ad299b5a1b7ead6fe068996f9f4b17c0a5a4674c584d6b99f4f1b

SHA512
0ff6e5fd56876383acf553003479085cb539475f8a4e496f59858c0ebfc07aede3b873c7743d55568f023d95ffa5ac7e8a56a6cbd426f5a5e72e4d67a7a140b0

Download Submit