0f697e9cca3455c8e54b7b049b4e9632115634615f38e43ddbeb781d978354db

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

web-client/translations/is.json
Size

45KB
MD5

018131f654bc456870314351c63ac1f5
SHA1

303a8e90a82b310fd456aa49b24aa00e48c168d1
SHA256

bb71c4b1fc04eb15c599cc50d7124c13f78a1bef45ef72d68fff3982ed87e355
SHA512

b6a2bd2c2f9583078c1a5aca8497d78b6d69dcc42551dda95896ff731607af641fefa91bc48f24c997b1451e0bd31b820fef9c0cb0c953451b73ed6113207446
SSDEEP

768:hfeZmxrxJuav6L8szc3KECFatTmDsIQQCLW5slOwizkEZ6h:hxxJuaKJMIatTmDsIQQCL8WOw9EZq

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2528	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2528	AcroRd32.exe
2528	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2340	1972	cmd.exe	29
PID 1972 wrote to memory of 2340	1972	cmd.exe	29
PID 1972 wrote to memory of 2340	1972	cmd.exe	29
PID 2340 wrote to memory of 2528	2340	rundll32.exe	30
PID 2340 wrote to memory of 2528	2340	rundll32.exe	30
PID 2340 wrote to memory of 2528	2340	rundll32.exe	30
PID 2340 wrote to memory of 2528	2340	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\web-client\translations\is.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\web-client\translations\is.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\web-client\translations\is.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3ab7b3a7497d117c930255d68be460f0

SHA1
995e06724ec103adda86314c60ba676b79ea5c52

SHA256
53b37fff1916c05558071efacee7df783ecdb1c5addba9bb237ed3745ea6e896

SHA512
e234699e1cfae921d8d63c8468fee66308bcecc47f6da89b5ce605e4b192f638bc70e65fb5839d349e698edca9d816049ab2dd05539d73ad8c2c2559dddb6ea5

Download Submit