942efbdef7fa8da978826a7bf1ce4c9413888321e7aa6b276ed0c6c51b7e0e73

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Akiserver/Aki_Data/Server/configs/bot.json
Size

59KB
MD5

c1b2ead4c55c36357d56e99d99194f05
SHA1

f82f97ba8ad26dc08c15085a31563f70427ace4b
SHA256

7ff00327ab508e994a9c25c42eebacb215f36296d60c702f8ac43ef3f9836e87
SHA512

6f596e2dad01c7d2d5d61d5bcf834479a6755b524998a5202814f55fd61db5c99e1a2c13f80555ffc16e7d7db707a494828e814104afbc5b69e497689c414df4
SSDEEP

384:BMI3js4knlClW1ml7lHszdIbkilKlZl6lJlAbgZVmDWcltXaMh6CH:BuWgtgw

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2576	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2576	AcroRd32.exe
2576	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2676	2144	cmd.exe	29
PID 2144 wrote to memory of 2676	2144	cmd.exe	29
PID 2144 wrote to memory of 2676	2144	cmd.exe	29
PID 2676 wrote to memory of 2576	2676	rundll32.exe	30
PID 2676 wrote to memory of 2576	2676	rundll32.exe	30
PID 2676 wrote to memory of 2576	2676	rundll32.exe	30
PID 2676 wrote to memory of 2576	2676	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Akiserver\Aki_Data\Server\configs\bot.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Akiserver\Aki_Data\Server\configs\bot.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Akiserver\Aki_Data\Server\configs\bot.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8ee2311f56d03f00f0b4dbb463a8feb1

SHA1
985f6fed37ffa7c3ad6052459bcdf1a0de4de727

SHA256
03f9d38354a29e6e6662da7ecf876b32861dc463f06655e8b517e2f36a38bb35

SHA512
d5e493591667103d36ef0c19a21f6d8356e715ef3f914020755cf842b663496e28cbb20d7aa61e0f10a55d359ed14757bc9b5d1bf1b5c742d9e6a12634ab4738

Download Submit