0f697e9cca3455c8e54b7b049b4e9632115634615f38e43ddbeb781d978354db

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

web-client/translations/hr.json
Size

111KB
MD5

6cc56280fc8a1b952bc1940ce522c80c
SHA1

bae76ed798d0df6162bfc9e4332e3e5c0350ce89
SHA256

a4d0a59b342c96c098c0360585ae533048a03d4d96986175e8872f634c12b244
SHA512

dc8517064391b80350111161e9927752379903518a8657c9cd8f11bf57d3a4a3f2cd28d178bddf6c93c07bc60971ba6a0d64f2f9ac5622508d769e8e1aad2dbf
SSDEEP

3072:nTLRK032Vj7Onfe15Gn+OOV/Brf/DWsBVhZtKx135J6FMNhlw3+lBvYa:Hk6e15G0NftAZw3+73

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2628	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2628	AcroRd32.exe
2628	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2376	1368	cmd.exe	29
PID 1368 wrote to memory of 2376	1368	cmd.exe	29
PID 1368 wrote to memory of 2376	1368	cmd.exe	29
PID 2376 wrote to memory of 2628	2376	rundll32.exe	30
PID 2376 wrote to memory of 2628	2376	rundll32.exe	30
PID 2376 wrote to memory of 2628	2376	rundll32.exe	30
PID 2376 wrote to memory of 2628	2376	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\web-client\translations\hr.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\web-client\translations\hr.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\web-client\translations\hr.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
49c6ce0e66a78c2baefef169433d7762

SHA1
15ae87904606ce6f398483a7041aa87489d524c3

SHA256
04cadf2f6e614232e8df54a25b38a4cefc9ec6fe7ea9b525a0e3542d3c243196

SHA512
095f2825c7f739c1cd0d1002e7ff0f65bdfd56aecab2ea2ead763574e23e3f2916c2d7be77316446270ec2831fef1f71e6a0de3f834fa0fab102da326ad39aa9

Download Submit