fbae68a26f20150a540f528586f8bd47e5eadac3b111995da5e77746305f145d

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20231130-en
resource tags

arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
submitted
04/12/2023, 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tf2hud-editor/JSON/zeeshud.json
Size

25KB
MD5

fee9d7a4d9b75443216b60364cd84406
SHA1

2e0307b2b4145afe5c44b933143539cf5b134de4
SHA256

36431a03caf416f71b4a2b7c6d09a08c44647afe4aec646a2796ba06e62e89d0
SHA512

afa95945aafd196f8295fc57be95f5f8451e851ad1e3dbb02090e8bfdc4dd7b4e1b24ee44703c2ada3d9879eef13847ce03a99528cb57f30d0af575d8255fa2e
SSDEEP

192:WiJYs1dFlorULYhu80Me0z0VN0w0+M0Q0/E0x0x60J0hF0G0Ad000aP09z0Sts0A:31FPkP87aAhBqjnpnrNuLN

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2596	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2596	AcroRd32.exe
2596	AcroRd32.exe
2596	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2108	2196	cmd.exe	29
PID 2196 wrote to memory of 2108	2196	cmd.exe	29
PID 2196 wrote to memory of 2108	2196	cmd.exe	29
PID 2108 wrote to memory of 2596	2108	rundll32.exe	30
PID 2108 wrote to memory of 2596	2108	rundll32.exe	30
PID 2108 wrote to memory of 2596	2108	rundll32.exe	30
PID 2108 wrote to memory of 2596	2108	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\JSON\zeeshud.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\JSON\zeeshud.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\JSON\zeeshud.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6c69f986e07b8066ce17a603234488bb

SHA1
f1017886bbc386d4778362465daff14cc2d54edb

SHA256
b16aa5c35c8ff2fdfc9ac4b426f64eca0a8a606ecbb17119f459c445244c638f

SHA512
b04da3c85860e4cc807a33b8b9ec64662ef0b05df74055d20c70398b46da2a327288ac89f23455ac7cc4dd38e121f5d7ea53900c66cd47fd8bc43e33b6c84525

Download Submit