fbae68a26f20150a540f528586f8bd47e5eadac3b111995da5e77746305f145d

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/12/2023, 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tf2hud-editor/JSON/hypnotize-hud.json
Size

22KB
MD5

16952927d4f2ec09434090a536a21f09
SHA1

47d92fe21ce1771e8d60ab669849ded925b4ef73
SHA256

edb1dcbeb5f4304b9b3615895554083d4c017882f1cbf9509548e596023df7bc
SHA512

59163ddeed57bf33e0d0a3a99a714215c0b637a65cd7e41436e1973b5ef72a520211b795a8cf174047ece064f47f54b5816a0f71f53402f26e6ab67c1fd61deb
SSDEEP

192:WiJCfASl/iNgo/QyyKbTo0/pCkq0LEoUz+PNArc+MMoB898Fe9E4FO9j49AV9FJB:3CkVTT1Arc+MpmsIw0+t

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2656	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2656	AcroRd32.exe
2656	AcroRd32.exe
2656	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 3040	2408	cmd.exe	29
PID 2408 wrote to memory of 3040	2408	cmd.exe	29
PID 2408 wrote to memory of 3040	2408	cmd.exe	29
PID 3040 wrote to memory of 2656	3040	rundll32.exe	30
PID 3040 wrote to memory of 2656	3040	rundll32.exe	30
PID 3040 wrote to memory of 2656	3040	rundll32.exe	30
PID 3040 wrote to memory of 2656	3040	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\JSON\hypnotize-hud.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\JSON\hypnotize-hud.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\JSON\hypnotize-hud.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a954937c0ebffa8392c70e189f944063

SHA1
1db16387efaabf8e3e286f13f4625270b3a4b5a9

SHA256
8b053a23669e8e3c5e064e4423ec9a110b7ac0222c4bc699ce77dc363c854eca

SHA512
f69f65b89c6a04d5fe6ffdbdca6d43086ff5b3e4260d24f4e11b8391040ec953b54b0348010b4fa0648ae129758534cfeb9e437e6147bdebd89fe18ceba6cae5

Download Submit