96e6276b4d1ff728b1e2014a3be856a5e35a6a885df0797a54728868798feac2

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dark The Finals.deps.json
Size

63KB
MD5

9369ec8172b9b54d4ffca97aacfde418
SHA1

e089a8aeb381f234e8134c223b48f61315981d65
SHA256

cc855ab58ebac3912f0cf0766354f956c8ed7703f985003a5980d8105aad4a6f
SHA512

61336a29a609464d41d6dd70a0e1a616db6001c5891d0e5e5a7313cd4448f1921c29d51ba21e9303455de9ecb288a61a16a855bf35e10be0a864f6e1eab62cfb
SSDEEP

1536:JUvj/v37X1lcu7znBARSiL1ONeljpZKSts2hR:JAlcu7znBARSiL1ONeljpZKStbR

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2776	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2776	AcroRd32.exe
2776	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2704	2672	cmd.exe	29
PID 2672 wrote to memory of 2704	2672	cmd.exe	29
PID 2672 wrote to memory of 2704	2672	cmd.exe	29
PID 2704 wrote to memory of 2776	2704	rundll32.exe	30
PID 2704 wrote to memory of 2776	2704	rundll32.exe	30
PID 2704 wrote to memory of 2776	2704	rundll32.exe	30
PID 2704 wrote to memory of 2776	2704	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Dark The Finals.deps.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dark The Finals.deps.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dark The Finals.deps.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d29a10da01d72070ff078bfde8ef78f6

SHA1
5983d1a2db65a0bcba2eb1d484da10e501da117b

SHA256
8e15792b562aabc4a3ae7f6e1b4ec9a6335577b3d94920a31e2d27d94e9c4802

SHA512
e1f220bdcdb08cfda94d26b0e02ac409017d8ed25b8bc293555143d54e64d195f8807f85a6743f5462d94fb5265fb69f9e1a655ca1664221224fa3870f493d23

Download Submit