96e6276b4d1ff728b1e2014a3be856a5e35a6a885df0797a54728868798feac2

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dark The Finals.deps.json
Size 63KB
Sample240124-emdkpaabbn
SHA256 cc855ab58ebac3912f0cf0766354f956c8ed7703f985003a5980d8105aad4a6f
MD5 9369ec8172b9b54d4ffca97aacfde418
SHA1 e089a8aeb381f234e8134c223b48f61315981d65
SHA512 61336a29a609464d41d6dd70a0e1a616db6001c5891d0e5e5a7313cd4448f1921c29d51ba21e9303455de9ecb288a61a16a855bf35e10be0a864f6e1eab62cfb
SSDEEP 1536:JUvj/v37X1lcu7znBARSiL1ONeljpZKSts2hR:JAlcu7znBARSiL1ONeljpZKStbR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2776	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2776	AcroRd32.exe
2776	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2704	2672	cmd.exe	29
PID 2672 wrote to memory of 2704	2672	cmd.exe	29
PID 2672 wrote to memory of 2704	2672	cmd.exe	29
PID 2704 wrote to memory of 2776	2704	rundll32.exe	30
PID 2704 wrote to memory of 2776	2704	rundll32.exe	30
PID 2704 wrote to memory of 2776	2704	rundll32.exe	30
PID 2704 wrote to memory of 2776	2704	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Dark The Finals.deps.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dark The Finals.deps.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dark The Finals.deps.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 8e15792b562aabc4a3ae7f6e1b4ec9a6335577b3d94920a31e2d27d94e9c4802
MD5 d29a10da01d72070ff078bfde8ef78f6
SHA1 5983d1a2db65a0bcba2eb1d484da10e501da117b
SHA512 e1f220bdcdb08cfda94d26b0e02ac409017d8ed25b8bc293555143d54e64d195f8807f85a6743f5462d94fb5265fb69f9e1a655ca1664221224fa3870f493d23
MD5 SHA1 SHA512

Submit Download