9a76db52356b41f0234e463b8573680cd98a7869623d5520e7840b6878077c8d

Analysis

max time kernel
182s
max time network
175s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
17-11-2023 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TypeScript-5.2.2/tests/projects/resolveJsonModuleAndComposite/tsconfig_withInclude.json
Size

302B
MD5

00c8cb521a8e46d4eafe350411fbb1ac
SHA1

d13584054950d54c2dc896a27a04bb3de6e24561
SHA256

b0377517ac1bdba3510be879f134ac8cd9fe7f256c13068ca7042c4d69c1312e
SHA512

57cd41fa2422aa539c43176ba54db3f8e6c31d9c799b931db12e608a9a0f80f4555b400f0b2b3f4d74faf19cf4455d0507f8f9d37ed803d4f4c26bb6c38d19d3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3040	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2560	2688	cmd.exe	30
PID 2688 wrote to memory of 2560	2688	cmd.exe	30
PID 2688 wrote to memory of 2560	2688	cmd.exe	30
PID 2560 wrote to memory of 3040	2560	rundll32.exe	31
PID 2560 wrote to memory of 3040	2560	rundll32.exe	31
PID 2560 wrote to memory of 3040	2560	rundll32.exe	31
PID 2560 wrote to memory of 3040	2560	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TypeScript-5.2.2\tests\projects\resolveJsonModuleAndComposite\tsconfig_withInclude.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\TypeScript-5.2.2\tests\projects\resolveJsonModuleAndComposite\tsconfig_withInclude.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TypeScript-5.2.2\tests\projects\resolveJsonModuleAndComposite\tsconfig_withInclude.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a88e6228a540372f440d4c68f24961d4

SHA1
9e52765d11df69f3b44af68dba76283445ce2caf

SHA256
d61a3e613af9d78e55733139e3913a89884d704671c061e64e0a2153a36170f6

SHA512
034e1758aee4397fa0a711c2342c9b845bd1987e5a3973adef305689b738c45c801d3b2292c505d108d0cc527e71aab4900a3b3fe61240d0337e0f36688008dd

Download Submit