Overview
overview
8Static
static
7Minecraft(...l].apk
android-9-x86
8Y-6ca8b.png
windows7-x64
3Y-6ca8b.png
windows10-2004-x64
3Y-8026f.png
windows7-x64
3Y-8026f.png
windows10-2004-x64
3Y-a4c5f.png
windows7-x64
3Y-a4c5f.png
windows10-2004-x64
3Y-ac591.png
windows7-x64
3Y-ac591.png
windows10-2004-x64
3Y-ebacf.png
windows7-x64
3Y-ebacf.png
windows10-2004-x64
3Y-f85a0.png
windows7-x64
3Y-f85a0.png
windows10-2004-x64
3Z-190a8.png
windows7-x64
3Z-190a8.png
windows10-2004-x64
3Z-dac4f.png
windows7-x64
3Z-dac4f.png
windows10-2004-x64
3_global_va...s.json
windows7-x64
3_global_va...s.json
windows10-2004-x64
3_ui_defs.json
windows7-x64
3_ui_defs.json
windows10-2004-x64
3abandoned_...t.json
windows7-x64
3abandoned_...t.json
windows10-2004-x64
3absorption_effect.png
windows7-x64
3absorption_effect.png
windows10-2004-x64
3absorption_heart.png
windows7-x64
3absorption_heart.png
windows10-2004-x64
3absorption...lf.png
windows7-x64
3absorption...lf.png
windows10-2004-x64
3acacia_boat.json
windows7-x64
3acacia_boat.json
windows10-2004-x64
3acacia_door.json
windows7-x64
3Analysis
-
max time kernel
172s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16-10-2023 18:16
Static task
static1
Behavioral task
behavioral1
Sample
Minecraft(1.18.2.03) V6 [Skyrrel].apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
Y-6ca8b.png
Resource
win7-20230831-en
Behavioral task
behavioral3
Sample
Y-6ca8b.png
Resource
win10v2004-20230915-en
Behavioral task
behavioral4
Sample
Y-8026f.png
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
Y-8026f.png
Resource
win10v2004-20230915-en
Behavioral task
behavioral6
Sample
Y-a4c5f.png
Resource
win7-20230831-en
Behavioral task
behavioral7
Sample
Y-a4c5f.png
Resource
win10v2004-20230915-en
Behavioral task
behavioral8
Sample
Y-ac591.png
Resource
win7-20230831-en
Behavioral task
behavioral9
Sample
Y-ac591.png
Resource
win10v2004-20230915-en
Behavioral task
behavioral10
Sample
Y-ebacf.png
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
Y-ebacf.png
Resource
win10v2004-20230915-en
Behavioral task
behavioral12
Sample
Y-f85a0.png
Resource
win7-20230831-en
Behavioral task
behavioral13
Sample
Y-f85a0.png
Resource
win10v2004-20230915-en
Behavioral task
behavioral14
Sample
Z-190a8.png
Resource
win7-20230831-en
Behavioral task
behavioral15
Sample
Z-190a8.png
Resource
win10v2004-20230915-en
Behavioral task
behavioral16
Sample
Z-dac4f.png
Resource
win7-20230831-en
Behavioral task
behavioral17
Sample
Z-dac4f.png
Resource
win10v2004-20230915-en
Behavioral task
behavioral18
Sample
_global_variables.json
Resource
win7-20230831-en
Behavioral task
behavioral19
Sample
_global_variables.json
Resource
win10v2004-20230915-en
Behavioral task
behavioral20
Sample
_ui_defs.json
Resource
win7-20230831-en
Behavioral task
behavioral21
Sample
_ui_defs.json
Resource
win10v2004-20230915-en
Behavioral task
behavioral22
Sample
abandoned_mineshaft.json
Resource
win7-20230831-en
Behavioral task
behavioral23
Sample
abandoned_mineshaft.json
Resource
win10v2004-20230915-en
Behavioral task
behavioral24
Sample
absorption_effect.png
Resource
win7-20230831-en
Behavioral task
behavioral25
Sample
absorption_effect.png
Resource
win10v2004-20230915-en
Behavioral task
behavioral26
Sample
absorption_heart.png
Resource
win7-20230831-en
Behavioral task
behavioral27
Sample
absorption_heart.png
Resource
win10v2004-20230915-en
Behavioral task
behavioral28
Sample
absorption_heart_half.png
Resource
win7-20230831-en
Behavioral task
behavioral29
Sample
absorption_heart_half.png
Resource
win10v2004-20230915-en
Behavioral task
behavioral30
Sample
acacia_boat.json
Resource
win7-20230831-en
Behavioral task
behavioral31
Sample
acacia_boat.json
Resource
win10v2004-20230915-en
Behavioral task
behavioral32
Sample
acacia_door.json
Resource
win7-20230831-en
General
-
Target
acacia_door.json
-
Size
464B
-
MD5
6debade82ac3d25a47bd2984cf216f3d
-
SHA1
0e74e59dd8e2c67b64b1f86147427c5c8c67f83d
-
SHA256
438cf826fe33e9b8234a2cfec29be9fe057251536b514795409948df5d6576ac
-
SHA512
b52b6730871233c285998e45556a42ac332ee6b1c109368a58e00bd8b6a5c3987ffb3a7a45fe9e3271f8709d21d20b895cfb96a65fca84d5d441ebdd8d8665c3
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\json_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\.json rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\json_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\json_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1736 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1736 AcroRd32.exe 1736 AcroRd32.exe 1736 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1452 wrote to memory of 2000 1452 cmd.exe 29 PID 1452 wrote to memory of 2000 1452 cmd.exe 29 PID 1452 wrote to memory of 2000 1452 cmd.exe 29 PID 2000 wrote to memory of 1736 2000 rundll32.exe 30 PID 2000 wrote to memory of 1736 2000 rundll32.exe 30 PID 2000 wrote to memory of 1736 2000 rundll32.exe 30 PID 2000 wrote to memory of 1736 2000 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\acacia_door.json1⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\acacia_door.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\acacia_door.json"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1736
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD56970cb763c5ab405369c83fba676ba6f
SHA1317f9ce4cb45054adaed01463b27a1adfe5e985e
SHA25617c8b2af5b34a401dbe7e8dd753e875cc20018a2ff4d5cbe79eb7a22c829c848
SHA5122782acbf47976b64cd861410930d0d7411c5d96650b2f0f50090b3464fa14b5b4a5513917d5de6968ce5f62c446802d9843faffae7a9d32c1354cc630def475b