eb19dd67fdae4ca09fd29f17308a4fb82a29d314b7e067bc5d4119e8b1ae914f

Analysis

max time kernel
152s
max time network
128s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AIMi - AI Aimbot/nvidia docker/daemon.json
Size

136B
MD5

977c544b2137c912068c2b7787ee9835
SHA1

6f17f0e2e4e021c90ff4cd734fc8b3dc07a63e54
SHA256

ab5f4f203a04fba05022056a3ffe77cb86ee4301f531730e6a013652cde8b3b3
SHA512

25f3f3009c95e8857a91b8cff6d8adbd43943fa5dbfc7588e7d20a473e958f453aa6d56c01f94ffc0408965da58f8e72befa8a8bd14eed2fdb5d4481892debf2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2724	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2724	AcroRd32.exe
2724	AcroRd32.exe
2724	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1500	2228	cmd.exe	29
PID 2228 wrote to memory of 1500	2228	cmd.exe	29
PID 2228 wrote to memory of 1500	2228	cmd.exe	29
PID 1500 wrote to memory of 2724	1500	rundll32.exe	30
PID 1500 wrote to memory of 2724	1500	rundll32.exe	30
PID 1500 wrote to memory of 2724	1500	rundll32.exe	30
PID 1500 wrote to memory of 2724	1500	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\AIMi - AI Aimbot\nvidia docker\daemon.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AIMi - AI Aimbot\nvidia docker\daemon.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AIMi - AI Aimbot\nvidia docker\daemon.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
af07f8f9b06dfa97844eaa6fd02c3693

SHA1
ce05fba2ed8219c01e82625dc2cd3f7c3c6e8244

SHA256
63294dc74cff8c3dfd470b3398e222229de3cc77a9fb84fa44b384635c4e87b0

SHA512
629bf92f3141fb4d1324c468d6c14377a8f789b3c0aacf7467924166f9f9a07f7953ffc832e0fecd3dee76b325b33c8aa84d5f1e760879d800609f7083bf9099

Download Submit