105cc8958dde5aa748097eacf59edb7ff70f5826fe754ade45d4a4545f47fe4f

Analysis

max time kernel
151s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24/11/2023, 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mechvibes-2.3.0/package-lock.json
Size

152KB
MD5

d017782215825ac75fd5a35b0dd3299c
SHA1

07269738a1a2eec50e983e3135ad91281541cb79
SHA256

1ea5232bb7acbdd4761b75ea8e61c428c358a991506ab6d134862bd48e1c854e
SHA512

95e24497e53489ada83874bbe07f23c2cb5143ce13a0992bdb3c5bfd7c53b12f103d28be73d93cef16a18fba5174851dea0b533565a8a270035234f1fd1042c5
SSDEEP

1536:HiaWLxfaRqZ5VGD3XBXBkOLvPoUBc5hLrj2UDri/X:HSIQ5VGbx+OLvPoNhLGUDri/X

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\json_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2772	AcroRd32.exe
2772	AcroRd32.exe
2772	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 1532	2364	cmd.exe	29
PID 2364 wrote to memory of 1532	2364	cmd.exe	29
PID 2364 wrote to memory of 1532	2364	cmd.exe	29
PID 1532 wrote to memory of 2772	1532	rundll32.exe	30
PID 1532 wrote to memory of 2772	1532	rundll32.exe	30
PID 1532 wrote to memory of 2772	1532	rundll32.exe	30
PID 1532 wrote to memory of 2772	1532	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mechvibes-2.3.0\package-lock.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\mechvibes-2.3.0\package-lock.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\mechvibes-2.3.0\package-lock.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
42c5f03809fd5bea03d749ed5ec09515

SHA1
3a9f8e01b36ca28e669c1c1d21894e8444ede087

SHA256
e28b7edcdaa0a9acb73bca3fac8298a19250af6802b0c75ea9ae638e0dbe0705

SHA512
8765cd508a1bb0abbc3e803706303e8706478f330ea1e6364a7bce05fd1f6d2093452852843f9bfbef196bcb30932a0374063360d31b3dba09f0396c655634cb

Download Submit