fbae68a26f20150a540f528586f8bd47e5eadac3b111995da5e77746305f145d

Analysis

max time kernel
152s
max time network
129s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04-12-2023 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tf2hud-editor/JSON/sunsethud.json
Size

19KB
MD5

3077497936a8001c17e6d18024352a0f
SHA1

8587585329565efdfc6e0100594a770ea02e8774
SHA256

fac609f806332da216f0d617d20064450f0a44c566d54951d4140cfde18fe754
SHA512

cc55fdf11e8d248577f3003e4d89df3554ee79db5b0c133dcf10654a75969df49cd6eb14415ac072846b057a447759ad8036767b51debdc216d3d5a27189fef3
SSDEEP

192:WiJNIENZUF/Qeeo+H1woqEtJN98j/381jKMEwUV9gd5v25EuE3EYTCoumoSEGB2J:3Ld98j/3SZ0YrKOR8BDt

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2836	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2836	AcroRd32.exe
2836	AcroRd32.exe
2836	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 2220	1060	cmd.exe	29
PID 1060 wrote to memory of 2220	1060	cmd.exe	29
PID 1060 wrote to memory of 2220	1060	cmd.exe	29
PID 2220 wrote to memory of 2836	2220	rundll32.exe	30
PID 2220 wrote to memory of 2836	2220	rundll32.exe	30
PID 2220 wrote to memory of 2836	2220	rundll32.exe	30
PID 2220 wrote to memory of 2836	2220	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\JSON\sunsethud.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\JSON\sunsethud.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\JSON\sunsethud.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
616a2727e3a3345a623cc07563987ac2

SHA1
11ff8a9bb691af2266aa15103625665cde4f7850

SHA256
e13b11be5d4267ca95414dbb900a05c2f31c91d5e80b2c1c5c5e748615291fc4

SHA512
543cbbca3ee1ab3bdb4be2fb9dc21a36b9ef50b381a9c3a97759aa0eb366cee0f424e5f07de05061ef91e2067c7ed6b50891d5eb061d3b6e6762f5d2dd98d5d5

Download Submit