de18b52ce66da390186a8981f6286402de23fe686408327c26a6b5ea98b01c84

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

extension/server/node_modules/wrappy/package.json
Size

606B
MD5

788804d507f3ed479ea7614fa7d3f1a5
SHA1

156d61004996b07079664753e7b5c415b99e4c89
SHA256

712ac9c4c3cef8bc79f42cf6075ff18551f4cb768f35158214fd643853ad7abc
SHA512

de6a00f64974710b12c0f5c39fb4720af0292527e380594eaa9446790562412a77121f6945315cfec5e360919dd94ad4e6c43598018f0d43527b3d634fd0954d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2640	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2640	AcroRd32.exe
2640	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2008	1416	cmd.exe	20
PID 1416 wrote to memory of 2008	1416	cmd.exe	20
PID 1416 wrote to memory of 2008	1416	cmd.exe	20
PID 2008 wrote to memory of 2640	2008	rundll32.exe	30
PID 2008 wrote to memory of 2640	2008	rundll32.exe	30
PID 2008 wrote to memory of 2640	2008	rundll32.exe	30
PID 2008 wrote to memory of 2640	2008	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\extension\server\node_modules\wrappy\package.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\extension\server\node_modules\wrappy\package.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\extension\server\node_modules\wrappy\package.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
517c992f27b2b023f51bb348524570ab

SHA1
8b1070dde8eea9573df7539ba1d12891f402e62b

SHA256
bec3811de35854083a885c2bb2acd009b9083921fac7b711694773dccebf7541

SHA512
e564b4eab151c8085244b91e1faf9bb3f7c3f46372df3b2d25e4b5d23f4c093c82ca6145c5cb0a626f286fe1bed614658a729e9cefd5b4695651a8919cd900d6

Download Submit