03d201a14bcbd0601a4d5952093befcc067f114270e4a2e02b874adcdf1eb72f

Analysis

max time kernel
214s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

assets/minecraft/mcpatcher/sky/world0/sky7.properties
Size

105B
MD5

1d776ce1edce851e316ace6bb4abcd43
SHA1

db4486b8d7a2dcdef1f6ec3c6ff557670b3d5a43
SHA256

5de61616dcc8a2b8d16f9217fbd6cc8a3f44dec714bb418ec9caf71a2b46f70e
SHA512

20662e960c286295dea5bcbb2ed012b17facf76ee76466bc71bec9304dcc4ec58356347a4df40f87d24d3f5e99386256127861588039cd10669a064946a8fc5d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\properties_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\properties_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.properties	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\properties_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\properties_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\properties_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.properties\ = "properties_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\properties_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1096	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1096	AcroRd32.exe
1096	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2716	1900	cmd.exe	30
PID 1900 wrote to memory of 2716	1900	cmd.exe	30
PID 1900 wrote to memory of 2716	1900	cmd.exe	30
PID 2716 wrote to memory of 1096	2716	rundll32.exe	31
PID 2716 wrote to memory of 1096	2716	rundll32.exe	31
PID 2716 wrote to memory of 1096	2716	rundll32.exe	31
PID 2716 wrote to memory of 1096	2716	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\mcpatcher\sky\world0\sky7.properties
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\assets\minecraft\mcpatcher\sky\world0\sky7.properties
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\mcpatcher\sky\world0\sky7.properties"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
039d03f10ca7ae3c4aee5d8e5a328d25

SHA1
e64468c3b81eda8c034d4d6cdce062d3c88ec31e

SHA256
d4db2d16e7eccb717dfb0d7416034627512396877ec555172ca30a8121534cc2

SHA512
05dff42af230c46c8e7c2cec81bbc8e25e547288e3f50d1f83d62341f091399bc7b8e725f0e1d6f8d0b6d257d7190b9ebb85d6bef871878fe489dc16f45c5f99

Download Submit