03d201a14bcbd0601a4d5952093befcc067f114270e4a2e02b874adcdf1eb72f

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

assets/minecraft/mcpatcher/sky/world0/sky2.properties
Size

136B
MD5

47536f5ba6c533db3aff8ac4888b8f5a
SHA1

7c616729ed245e27039634d14dfc79736c88b61d
SHA256

6f2b4b66e73b05aebac020cefa557d3aa4cf9e9cd30fe7d39a7e90522f33426f
SHA512

5d4bfbce7486b575b54b8250d124027c42f79f74af4b298f7362842e157e3a613aaf51d540526b2bdec829a153f34b49a2de22fb04982cd0cfb6076d4b60d0ca

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\properties_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\properties_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.properties	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\properties_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\properties_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.properties\ = "properties_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\properties_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\properties_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2612	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2612	AcroRd32.exe
2612	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2700	1696	cmd.exe	29
PID 1696 wrote to memory of 2700	1696	cmd.exe	29
PID 1696 wrote to memory of 2700	1696	cmd.exe	29
PID 2700 wrote to memory of 2612	2700	rundll32.exe	30
PID 2700 wrote to memory of 2612	2700	rundll32.exe	30
PID 2700 wrote to memory of 2612	2700	rundll32.exe	30
PID 2700 wrote to memory of 2612	2700	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\mcpatcher\sky\world0\sky2.properties
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\assets\minecraft\mcpatcher\sky\world0\sky2.properties
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\mcpatcher\sky\world0\sky2.properties"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
56d39212f3ac5d781d8f7caa91a8820f

SHA1
f8d063a2a93cd6d80ea621dc94a192c7a923cb74

SHA256
ef2b5503abe97237443e3384a2723930e9664de63ec453a42a3d52d42df9eba7

SHA512
efb6831bf1c4d7108f3572edd8fea82fcf5ca27bce93b33e49f9b432c9a83e4d443623948c666334ea7b558f5783c23e42f4292ae55f6bcef6242317fa2e7cb5

Download Submit