fbae68a26f20150a540f528586f8bd47e5eadac3b111995da5e77746305f145d

Analysis

max time kernel
152s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
04-12-2023 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tf2hud-editor/JSON/m0rehud.json
Size

36KB
MD5

1136fd21396654d2e1237b238a8282a3
SHA1

d6fd8a44bb93ce13d8a106749cbea1ccf272b945
SHA256

9b7687b2e831a3b6e81df03ec291f9f92e46faf88e1f8550ef3b3a7d25a7b0a7
SHA512

af8df9614543fd6e407449f8f73c517605a6932ab49a1b57ca40c605ef46dd1d867c73de7e8cca61d755cebbf5ef73af80a1466a3356d69c2913cb25a1b52aa5
SSDEEP

768:adT6+Y6pXC+dj8cYvjlFls+sPxZ1eqBX2:ax6D3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3000	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3000	AcroRd32.exe
3000	AcroRd32.exe
3000	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2148	2484	cmd.exe	29
PID 2484 wrote to memory of 2148	2484	cmd.exe	29
PID 2484 wrote to memory of 2148	2484	cmd.exe	29
PID 2148 wrote to memory of 3000	2148	rundll32.exe	30
PID 2148 wrote to memory of 3000	2148	rundll32.exe	30
PID 2148 wrote to memory of 3000	2148	rundll32.exe	30
PID 2148 wrote to memory of 3000	2148	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\JSON\m0rehud.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\JSON\m0rehud.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\JSON\m0rehud.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5e3d87a636157f82d1025f3f7be30554

SHA1
56d08829789e048143f35a7ca9aeafa48fbf296a

SHA256
4c8041b3d1ae1eae40e6bb4b55aa86d606ff4736b5a3d09605d7910e778ad639

SHA512
a75e06972c50b432391325ac964b51d11adedf4492740818191f184140a69046eb1d57732b67e686a2316aa448082c19dac0ff96fdbfa1588a1bb57338e8b6e4

Download Submit