565e3abc2f08e6231bb981c366fccfe42796b6ff530bdc66d1aaa5f7e23b05f0

Analysis

max time kernel
152s
max time network
131s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
11-11-2023 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Expensive-2.0/Expensive-2.0.json
Size

34KB
MD5

12f6083d7bd0ebfd6b55cf593cac8f1d
SHA1

2a0f6f4199353db2d851d6ed7e79f7c64302b39e
SHA256

ced3b928c09ae62b82db67346938e0bd83fcf14f103435a8bd505c69381913e1
SHA512

51a6049b5ba121ab237a8fdb80c21d27c02436a93abec2bce1d05f7be9220be47cc6b7cfc6ec8550b7a121970cf596c785bf859ca3a629ea9fb9bf2a9449ee2d
SSDEEP

192:gsukdxGa+aLaTsyvassia5aRPada2aeaRa8ma3NagVajaOyapaQa9axaRaSa/laU:gsnrg6+1pfbSqFCSdkI5U5h

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3028	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3028	AcroRd32.exe
3028	AcroRd32.exe
3028	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2176	2260	cmd.exe	29
PID 2260 wrote to memory of 2176	2260	cmd.exe	29
PID 2260 wrote to memory of 2176	2260	cmd.exe	29
PID 2176 wrote to memory of 3028	2176	rundll32.exe	30
PID 2176 wrote to memory of 3028	2176	rundll32.exe	30
PID 2176 wrote to memory of 3028	2176	rundll32.exe	30
PID 2176 wrote to memory of 3028	2176	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Expensive-2.0\Expensive-2.0.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Expensive-2.0\Expensive-2.0.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Expensive-2.0\Expensive-2.0.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7b1c0eea47584274326c65133788fdb5

SHA1
7f60196c0b13c7189dc405c8a24d6bf3d6e485da

SHA256
b5e809a6ca737e42b165cab7990024a3b5e56221d79d810501cc8eae671304b5

SHA512
96c82b7d554d63571830db17e5f384b45ff297bb9190e8a57ca8030a77421c1b668f59bd9d2de0b49964bb064c9049e2f867570b9cc4a5b28c0b9df2ee6e0806

Download Submit