0f697e9cca3455c8e54b7b049b4e9632115634615f38e43ddbeb781d978354db

Analysis

max time kernel
122s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

web-client/translations/ja.json
Size

265KB
MD5

45ac73de77ed72d77c3aa72971fd5ab8
SHA1

87796c847bde498f2ead76be33bfe58ae9b27c33
SHA256

3f794ff939bb1f8c772f9115922130bfbb657cf22dc1fb7f5f69edc6f04a5643
SHA512

e1d0384f5f35f4d995c2dc8e5390fc8e657349c97ba0d7f5b796e1216a35e58c037f9cd116a83c81ccbd7e52cfa25803b90d2270f88bdfd0427009ce383c56f3
SSDEEP

3072:YqawR0v4IsSAJj6P5nCIL0ddEUkl7xeAYb4Kw4o5xKphWl7/iuHDnUPjLqpNpldR:LAuuiEic

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2648	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2648	AcroRd32.exe
2648	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2508	2568	cmd.exe	29
PID 2568 wrote to memory of 2508	2568	cmd.exe	29
PID 2568 wrote to memory of 2508	2568	cmd.exe	29
PID 2508 wrote to memory of 2648	2508	rundll32.exe	30
PID 2508 wrote to memory of 2648	2508	rundll32.exe	30
PID 2508 wrote to memory of 2648	2508	rundll32.exe	30
PID 2508 wrote to memory of 2648	2508	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\web-client\translations\ja.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\web-client\translations\ja.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\web-client\translations\ja.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f34d2d5305f078046469ee3d3ec28a9a

SHA1
45c59c37971cd63b06b472ce283bf2ece9450b72

SHA256
eb602fed841ddf62f55444867fe3de2598d7f2e085f0515a872d712546de961b

SHA512
0df55435ef8be9a3d742529a54fff4236562a9c4fe8a4815a5aa8f8bd65668aa46705a4c69bbbc82fb305d1a60bebf877100885ebbbaeded98b571a23a1b3625

Download Submit