dcbb63002f5b6b4339ce494d3718e6517de650aeb4d3d72a601055f434f84949

Analysis

max time kernel
212s
max time network
152s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_ui_defs.json
Size

98B
MD5

d8374d122c3ba54000b7347c741bff0c
SHA1

fa4e8d311fa55ac1f7ebdf859437e662bb8c1d00
SHA256

48e09ad85d30d020041b46ed906c326791df890612aa9f95693eec3c87b83056
SHA512

3700ad3d3976a21ad5a9ddb1df22b5707235470891037d0094c24cffe2a5b26e247b8bda8e57b5117c57df5c64648c4a73cbe9ed01e7907b0d6394f945389d81

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\.json	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2280	AcroRd32.exe
2280	AcroRd32.exe
2280	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2448	2696	cmd.exe	30
PID 2696 wrote to memory of 2448	2696	cmd.exe	30
PID 2696 wrote to memory of 2448	2696	cmd.exe	30
PID 2448 wrote to memory of 2280	2448	rundll32.exe	32
PID 2448 wrote to memory of 2280	2448	rundll32.exe	32
PID 2448 wrote to memory of 2280	2448	rundll32.exe	32
PID 2448 wrote to memory of 2280	2448	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_ui_defs.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\_ui_defs.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\_ui_defs.json"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
12d4dcffa394b7da1572b72aa215f9ee

SHA1
42e0f011a89fb6534a696b9678568404ed08a8cc

SHA256
2337513fe28093c137175e53b9db595c5aa15f125a5526aaa3a4a83d525b7468

SHA512
90d24b31a84c968008cb1cc30fd969288a48b8032ac837d2c9613d3e11f409630f95eb30ebbabb0c1867da45dd630ae1d2a94277fe142c2faf2e513308add751

Download Submit