737c8aa1e9a435f9a4041a3132ed01595139f5c1cdeff1bc3d3b0ea7b2035aa8

Analysis

max time kernel
1799s
max time network
1571s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boredape/package-lock.json
Size

128KB
MD5

2a835b63032ea5428eb2a4447c67286c
SHA1

81b3450c5bfb1f73d149f332b5535d0d40dcde0f
SHA256

110b6e373aec26875adc84da4b45f154120b73bf22927c6473c335408135c8a5
SHA512

0b030115a7f0c590d6d5c286a7d39e70cd68db526fdaf1c4d238405043fe270ef42d1ca340cf4fb5ab5a9118ec56d2a99ede286dbca62d9ff9ac878672ff1bbf
SSDEEP

1536:aui/8z7KLsKY6V8sV88mhib8hlYcMmUZIpxvA14ksYUSi:/j3CJV5BNomI3A146i

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2996	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2996	AcroRd32.exe
2996	AcroRd32.exe
2996	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2296	1748	cmd.exe	29
PID 1748 wrote to memory of 2296	1748	cmd.exe	29
PID 1748 wrote to memory of 2296	1748	cmd.exe	29
PID 2296 wrote to memory of 2996	2296	rundll32.exe	30
PID 2296 wrote to memory of 2996	2296	rundll32.exe	30
PID 2296 wrote to memory of 2996	2296	rundll32.exe	30
PID 2296 wrote to memory of 2996	2296	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\boredape\package-lock.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\boredape\package-lock.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\boredape\package-lock.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
36867d93108ad24a02e66d454fb25732

SHA1
019efbdb8aa1143065c6e2db242455cee3972e3b

SHA256
9e9f4a0cc776d481b7e06205baa118c073fc17c034cf01c66189783ff647748a

SHA512
f2da3d52476879729da1e51e5cbb3c917a9a11a50fe3ae7d1afd7f51caf8fa30614208792940d61f1b22f7e8d3d1aa0e9e677d50f66fd86619e5af934b013230

Download Submit