1534753294da77aca8a7fc3c6f1008f8590a5a22794fda39d1876c603c82d04d

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UGC-Sniper-main/themes/required.json
Size

9KB
MD5

30e69d02f09052eab8bcabd5481c15e8
SHA1

e3e1f1d6ac40f2ba9a78b03ccd180c2bdd945ac9
SHA256

c238d9669fb4d34e9fe58d4bb6df0015040ac6cccdc7e583a935e4f204f64c6a
SHA512

79c6b4f3224fd6e0c1d5379a9a34366b886add8952747c954cb8ee397ce3688618789761bbdcc9fc3e6b6baf724cd747a5e38f6246190101a04fe726d46dd969
SSDEEP

96:JLqqSFF1DU7GShN7O6f+CoFxLQws6/cZMhvBFBl5NcytdN4t0ZgK2DOC+h0XO0mD:JLqz1LGnbCmKjmgBQLCVrsIFs+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2388	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2388	AcroRd32.exe
2388	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2812	2276	cmd.exe	29
PID 2276 wrote to memory of 2812	2276	cmd.exe	29
PID 2276 wrote to memory of 2812	2276	cmd.exe	29
PID 2812 wrote to memory of 2388	2812	rundll32.exe	30
PID 2812 wrote to memory of 2388	2812	rundll32.exe	30
PID 2812 wrote to memory of 2388	2812	rundll32.exe	30
PID 2812 wrote to memory of 2388	2812	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\UGC-Sniper-main\themes\required.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\UGC-Sniper-main\themes\required.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\UGC-Sniper-main\themes\required.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5f2ddd4a60589a2dc2b8e68f040ddea5

SHA1
a8a694d3287b31c9bae908ef2ec37a4ff34a8c6a

SHA256
8a9996e35417dfdae633e5ad94affa1572bc3b328aa55ecebb1685a78b129da6

SHA512
a2e2496e877579a5605a67727f3efa264aad15936b2b057c772efefe5f9a691d9f35e08ed8f99b04770147e87864dcdf432b3c8057a0315c8b1dbd22f218eec3

Download Submit