Overview
overview
3Static
static
1LuckyBlock...4].zip
windows7-x64
1LuckyBlock...4].zip
windows10-2004-x64
1manifest.json
windows7-x64
3manifest.json
windows10-2004-x64
3modlist.html
windows7-x64
1modlist.html
windows10-2004-x64
1overrides/...n.toml
windows7-x64
3overrides/...n.toml
windows10-2004-x64
3overrides/...t.toml
windows7-x64
3overrides/...t.toml
windows10-2004-x64
3overrides/...s.json
windows7-x64
3overrides/...s.json
windows10-2004-x64
3overrides/...t.toml
windows7-x64
3overrides/...t.toml
windows10-2004-x64
3overrides/...n.toml
windows7-x64
3overrides/...n.toml
windows10-2004-x64
3overrides/...r.toml
windows7-x64
3overrides/...r.toml
windows10-2004-x64
3overrides/...ck.zip
windows7-x64
1overrides/...ck.zip
windows10-2004-x64
1overrides/...s.json
windows7-x64
3overrides/...s.json
windows10-2004-x64
3overrides/...s.json
windows7-x64
3overrides/...s.json
windows10-2004-x64
3overrides/...s.json
windows7-x64
3overrides/...s.json
windows10-2004-x64
3overrides/...t.toml
windows7-x64
3overrides/...t.toml
windows10-2004-x64
3overrides/...n.toml
windows7-x64
3overrides/...n.toml
windows10-2004-x64
3overrides/...t.toml
windows7-x64
3overrides/...t.toml
windows10-2004-x64
3Analysis
-
max time kernel
129s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02-02-2024 00:30
Static task
static1
Behavioral task
behavioral1
Sample
LuckyBlockChallenge-(FORGE)-[1.0.4].zip
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
LuckyBlockChallenge-(FORGE)-[1.0.4].zip
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
manifest.json
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
manifest.json
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
modlist.html
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
modlist.html
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
overrides/config/appletreesrev-common.toml
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
overrides/config/appletreesrev-common.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
overrides/config/bhmenu-client.toml
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
overrides/config/bhmenu-client.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
overrides/config/biomesoplenty/biomes.json
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
overrides/config/biomesoplenty/biomes.json
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
overrides/config/biomesoplenty/client.toml
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
overrides/config/biomesoplenty/client.toml
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
overrides/config/biomesoplenty/generation.toml
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
overrides/config/biomesoplenty/generation.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
overrides/config/chancecubes/chancecubes-server.toml
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
overrides/config/chancecubes/chancecubes-server.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
overrides/config/chancecubes/custom_rewards/CustomSounds-Resourcepack.zip
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
overrides/config/chancecubes/custom_rewards/CustomSounds-Resourcepack.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
overrides/config/chancecubes/custom_rewards/sounds/sounds.json
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
overrides/config/chancecubes/custom_rewards/sounds/sounds.json
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
overrides/config/chancecubes/global_rewards.json
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
overrides/config/chancecubes/global_rewards.json
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
overrides/config/chancecubes/reward_settings.json
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
overrides/config/chancecubes/reward_settings.json
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
overrides/config/chaosawakens-client.toml
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
overrides/config/chaosawakens-client.toml
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
overrides/config/chaosawakens-common.toml
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
overrides/config/chaosawakens-common.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
overrides/config/configured-client.toml
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
overrides/config/configured-client.toml
Resource
win10v2004-20231215-en
General
-
Target
overrides/config/chaosawakens-client.toml
-
Size
1KB
-
MD5
91d01ed8fda61cab13b751436135e8f5
-
SHA1
530ec262d6f3a8da2081be7c8824819fa3293d4c
-
SHA256
93959bdaa67876f4300b7012c3f63b24d7d689d1ad1a37d31f0d19804ed7fd13
-
SHA512
48501409f0e30bc7e3dee179959d116a42a2accda51f52b3ec181f6827741a74a650ec13d69524ddcbf01ba88832b97c3a6639b52e4d6fbc5f5545dca3e57252
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\toml_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\toml_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\toml_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.toml rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.toml\ = "toml_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\toml_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\toml_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\toml_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 1796 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 1796 AcroRd32.exe 1796 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2692 wrote to memory of 2252 2692 cmd.exe rundll32.exe PID 2692 wrote to memory of 2252 2692 cmd.exe rundll32.exe PID 2692 wrote to memory of 2252 2692 cmd.exe rundll32.exe PID 2252 wrote to memory of 1796 2252 rundll32.exe AcroRd32.exe PID 2252 wrote to memory of 1796 2252 rundll32.exe AcroRd32.exe PID 2252 wrote to memory of 1796 2252 rundll32.exe AcroRd32.exe PID 2252 wrote to memory of 1796 2252 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\overrides\config\chaosawakens-client.toml1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\overrides\config\chaosawakens-client.toml2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\overrides\config\chaosawakens-client.toml"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5e2bd9628b7aa9acc9c06bbe5037cc7da
SHA1b8d0f70fa9e58c3663e1e710345f279d7a03707f
SHA2567a4c010f57181192efeb7e4ce8f7f5873b44efe51270fd3ab95d9be9ef5c9086
SHA512a658b2620f0048682ea139a65064aa60e568a23ceacfa2a4ea8bb6aa5878fe700eefebf93dc0c617bef41ecbbbf38e6b04d0c7c4aa040d4e2079b52d779b3b82