0f697e9cca3455c8e54b7b049b4e9632115634615f38e43ddbeb781d978354db

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

web-client/translations/fr-CA.json
Size

243KB
MD5

c10cca4a8d329051baec753502ad3be2
SHA1

af6328c7628d6772ec9fd09f8b2ab3b81bdf7da9
SHA256

f85b7b26d7b3a1c88906ebda7c36f584c562bf048608fb32e597467ea21c75f9
SHA512

c4e81a4ddb9ca1940826436c4ad2a7e7d536277ad264bc15b0403fe78216842d9893506429e48196f3d88ff4c8e10b015f6ca41abbfecfcc476bd9cf4b9d1c1e
SSDEEP

3072:dlgqCCLebiG1pHGD85hfcBozvxARhwwztAJCRjdE9goppkH0vDCVgO3OeyKxY0Hi:w+852x66YWUcfoXi31opKaAYmbNd7Q

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2452	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2452	AcroRd32.exe
2452	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2592	1940	cmd.exe	29
PID 1940 wrote to memory of 2592	1940	cmd.exe	29
PID 1940 wrote to memory of 2592	1940	cmd.exe	29
PID 2592 wrote to memory of 2452	2592	rundll32.exe	30
PID 2592 wrote to memory of 2452	2592	rundll32.exe	30
PID 2592 wrote to memory of 2452	2592	rundll32.exe	30
PID 2592 wrote to memory of 2452	2592	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\web-client\translations\fr-CA.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\web-client\translations\fr-CA.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\web-client\translations\fr-CA.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
87d5981fde1d87780794c47e11d100d9

SHA1
819450138067b35c0705d7aa02c3cc299e9ff96d

SHA256
3d9ea9c8db5479b8201c8b6edf62e4f05f570a159a91981292a00f841ca59474

SHA512
1f868437b93deec85c45f1ccf7ee96a760b6fc9db96b919efcd4d29a5c92094b45d2e40515f7ed91d9349c3d9965b481ee4e76091b6d7cf41d20f6227bd7eabb

Download Submit