cc3cf6f0724a8fc3d5275f895a62fd2d785b6ae61185d2068c317f440890195b

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

assets/minecraft/lang/cs_cz.json
Size

17KB
MD5

188f6a16e80a56d72480e4d2861439fb
SHA1

7a3f465ff1111577e8ca06aacf24c6f016d96a6c
SHA256

bcefa25882fec296fc58ba1a9d3c0add30d09db05b3bd8cba855170a556f3c0a
SHA512

abc42417f65ce9c46cfd5ffcaec85f9151784a9fc14964de7365cc26ad19ab7650343c72df25f995ec78e23e69b3b81ecec040dc9fa8c7d36111f714b2f11a3b
SSDEEP

384:ramcNYnsgonPEIgciLdEh2A7IK7ekVOqby:rxwYeBlVOqby

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.json	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2812	AcroRd32.exe
2812	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2528	1924	cmd.exe	29
PID 1924 wrote to memory of 2528	1924	cmd.exe	29
PID 1924 wrote to memory of 2528	1924	cmd.exe	29
PID 2528 wrote to memory of 2812	2528	rundll32.exe	30
PID 2528 wrote to memory of 2812	2528	rundll32.exe	30
PID 2528 wrote to memory of 2812	2528	rundll32.exe	30
PID 2528 wrote to memory of 2812	2528	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\lang\cs_cz.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\assets\minecraft\lang\cs_cz.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\lang\cs_cz.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
13a63cbc471b8f6153207b900fe94f74

SHA1
6ff4695fb45c8f798ab382c0c61da7b25d12f3ee

SHA256
8fb58c1dc79ab214d8bad143f31dbb37e2f59e9ad86dd63b09dcc24962c6535c

SHA512
b7de5cae3dd7e70832f5a1d58b236b396f3abe9b2ff76110b947372066ee54ffaee83b302badd647932c2cef8267401964116ad54e3391dc7acaf38327a80ce5

Download Submit