0f697e9cca3455c8e54b7b049b4e9632115634615f38e43ddbeb781d978354db

Analysis

max time kernel
122s
max time network
59s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

web-client/translations/ko.json
Size

188KB
MD5

cce543c80b9cb8d6ad769d8448857e1d
SHA1

d944c5ea39183241d938bd50a7b9b073fb7d3e0b
SHA256

a82ea5f8820b0226fbf22c2a7e54d341013e38bd35442d2c38cab679f5fa83c0
SHA512

f9096415c7fe4893a7fae79b26efdd3819b5135e0a4d0e127368017b6e64a070d56792ac570030e067e111739b8f9a4f071634d4cdb076f539a10b0c19e5c966
SSDEEP

3072:kz/pBqmWnu9uUrDDUJck36qU9gIxJilfb9R8FtABKtI8WAollsQU4Wwfwr5GSrlu:+C7agCYSFHulW4bt

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1096	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1096	AcroRd32.exe
1096	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2544	2028	cmd.exe	30
PID 2028 wrote to memory of 2544	2028	cmd.exe	30
PID 2028 wrote to memory of 2544	2028	cmd.exe	30
PID 2544 wrote to memory of 1096	2544	rundll32.exe	32
PID 2544 wrote to memory of 1096	2544	rundll32.exe	32
PID 2544 wrote to memory of 1096	2544	rundll32.exe	32
PID 2544 wrote to memory of 1096	2544	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\web-client\translations\ko.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\web-client\translations\ko.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\web-client\translations\ko.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8eba6f5f5bbb74056f971f1eb09502fb

SHA1
c072161f4f7e16025371ab57b67d282a8d506255

SHA256
f3001410815698baaae5846c9b44386c6c9ec3696bc0d0bd5d203cf516f0288e

SHA512
f2e153820e1f0779864a09fe5d6893a0872ba07d8289ef16b86bc7706cb542b83a1cd15d91bb84389149baa4bb0e20cfd68592bc6a84eae258951599085e14ed

Download Submit