6a9d79bb69419b2164a15919e28d1f770faf0e07d56191f02a03600c879907c6

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

META-INF/maven/co.aikar/acf-bukkit/pom.properties
Size

117B
MD5

6a31790361c5a45ae2968c552777a228
SHA1

cf3904c71dfe9d3df6de57125127dc030135e253
SHA256

9e1db08ab68c7015f7d6f811bd3dc2c9df0b24cbba41ce5068ab45113764fa2b
SHA512

5f0c33598a1d05802fc95aaa03fa1f315b2876946e8f4739f3f33a4d9a5cefd6e701df1a34f10f66c9c69575d0b2a86389e725ff89d2742cce8e46c8dd9c5a43

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\properties_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\properties_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\properties_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\properties_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\properties_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\properties_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.properties	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.properties\ = "properties_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2728	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2728	AcroRd32.exe
2728	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2668	2408	cmd.exe	29
PID 2408 wrote to memory of 2668	2408	cmd.exe	29
PID 2408 wrote to memory of 2668	2408	cmd.exe	29
PID 2668 wrote to memory of 2728	2668	rundll32.exe	30
PID 2668 wrote to memory of 2728	2668	rundll32.exe	30
PID 2668 wrote to memory of 2728	2668	rundll32.exe	30
PID 2668 wrote to memory of 2728	2668	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\META-INF\maven\co.aikar\acf-bukkit\pom.properties
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\META-INF\maven\co.aikar\acf-bukkit\pom.properties
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\META-INF\maven\co.aikar\acf-bukkit\pom.properties"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c4672938ccd7993e007121cce7fc4652

SHA1
1c79e4a3605b7cb62cc708554dad026d2732e18d

SHA256
76e775c24a62704eec6873b75906d65347a0b324d123e256374b7db0f7e80589

SHA512
ac7ea0ffb13c1f0725c2b662f2ed250154b271bb492503a9975f7f8ec51b7c5ce7b46cd9bbb59cc814adfcc814432dade782514e605bbec909c19901949f0281

Download Submit