cc3cf6f0724a8fc3d5275f895a62fd2d785b6ae61185d2068c317f440890195b

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

assets/minecraft/lang/en_us.json
Size

17KB
MD5

30c7eeb8611de48a903ec5cebf84b7d6
SHA1

cd8cdff233a5e46ea9581a025cb534b56e09fa56
SHA256

75dc0296fd3ae980d434a32e5e7cc87185dcd60a28b6e647b0072baa8ddcec9d
SHA512

acde8d1a874bc2f2c3841d30ec5dce2b098896029394f0dda8d9d814b1db8daf5131c01618851e24abd53d708e8201159fc46c7cebb5f983dd6686cf5916706f
SSDEEP

384:0nhyfVawMSOV0wxR4PGKAxI0fW7DtMtRctRCNtRHHRCP:ChyfLMp0I4PafoDtMHcHstRHxK

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2124	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2124	AcroRd32.exe
2124	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2644	2244	cmd.exe	29
PID 2244 wrote to memory of 2644	2244	cmd.exe	29
PID 2244 wrote to memory of 2644	2244	cmd.exe	29
PID 2644 wrote to memory of 2124	2644	rundll32.exe	30
PID 2644 wrote to memory of 2124	2644	rundll32.exe	30
PID 2644 wrote to memory of 2124	2644	rundll32.exe	30
PID 2644 wrote to memory of 2124	2644	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\lang\en_us.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\assets\minecraft\lang\en_us.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\lang\en_us.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3f28f5b4f8f69b26521dab702ed64075

SHA1
662abae9eeec6761d2910a697481429cb79247f0

SHA256
49c7b35ad694737fc0e333752c90af5ac1aac46c27153095c737888cf709cba4

SHA512
5a735c2a9d930023ff2962271d8bfdd58b658e58a1485c40c40808f96c4a3610ef3150de849c74ee2e4455569a7cbd445bd74eee8e0df803945145fec30672d7

Download Submit