0f697e9cca3455c8e54b7b049b4e9632115634615f38e43ddbeb781d978354db

Analysis

max time kernel
120s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

web-client/translations/it.json
Size

225KB
MD5

10e43d161d3c530ec39aac980fd6cffd
SHA1

18f93b8e7a4a36aa5e34ffe84e2e5d2f26a0a385
SHA256

272b294c704e340e1d19571120979c7782132ecab067d3e163a3d93e6fa7a685
SHA512

cc832fe518817877e79fe6031f759e2550a59000b14e3e48c242a6b6e0fe56399adf9199d01b1ad0d92ff73846012121ead281c11e19f8924e80b3472dab59e4
SSDEEP

6144:vr1PPFcu0I8I7StEC15sFyWk9ExyICMUC+hgwnRHmwJjZADxt3LG+a/2nMeh/THF:phkRVolX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2588	AcroRd32.exe
2588	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2584	2952	cmd.exe	29
PID 2952 wrote to memory of 2584	2952	cmd.exe	29
PID 2952 wrote to memory of 2584	2952	cmd.exe	29
PID 2584 wrote to memory of 2588	2584	rundll32.exe	30
PID 2584 wrote to memory of 2588	2584	rundll32.exe	30
PID 2584 wrote to memory of 2588	2584	rundll32.exe	30
PID 2584 wrote to memory of 2588	2584	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\web-client\translations\it.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\web-client\translations\it.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\web-client\translations\it.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ab2dbbce32e1cfb941989a2ba840eede

SHA1
9cf8091af5b5a94d8065269a0ab1088d0a40ee06

SHA256
2e63809e8f2015e8b5b801a9d73ead3d17302bd5fa69e34f319cf39ab02e17ff

SHA512
247211f3d1d6a916ab6a5a988097d0fe922552f6fae9c23ea646ecd952f8e9d041d9a2f42c0ab361e0ab7b8cf66b9ec5a3d1c75f6d93537e75c79f22c6bc77fa

Download Submit