50a39c4f6c43325e4ab440a3229d15c4d6ee1238e620d6d13ba2bc870cd4601e

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prometheus-main/Prometheus/config.json
Size

63B
MD5

08190d7825a514b4de0a70307542be28
SHA1

97f9c38be04780a22360413538f384e922d6c879
SHA256

45929be6bd7ebcc695e1dff53774e918c4b461e31b3d7413b0506332a43eb9b1
SHA512

41fd14aace3db4a9c2006b32dad5dd34b9c2d6da98b42a1a1456ee00fe01eb46fe836bab6ca778ca2516810466c696535aefacaff3f425ca90daefbd7d214440

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2704 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2704 AcroRd32.exe
2704 AcroRd32.exe

pid	process
2704	AcroRd32.exe

pid	process
2704	AcroRd32.exe
2704	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1032 wrote to memory of 2684	1032	cmd.exe	rundll32.exe
PID 1032 wrote to memory of 2684	1032	cmd.exe	rundll32.exe
PID 1032 wrote to memory of 2684	1032	cmd.exe	rundll32.exe
PID 2684 wrote to memory of 2704	2684	rundll32.exe	AcroRd32.exe
PID 2684 wrote to memory of 2704	2684	rundll32.exe	AcroRd32.exe
PID 2684 wrote to memory of 2704	2684	rundll32.exe	AcroRd32.exe
PID 2684 wrote to memory of 2704	2684	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Prometheus-main\Prometheus\config.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prometheus-main\Prometheus\config.json
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2684

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prometheus-main\Prometheus\config.json"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2704

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
cdf1d5d59f16c438b824f9ade8146383

SHA1
9263b327b183a15e9061cab6eb636651275d7bc6

SHA256
41c7c1a121e56d481af6f842c4d8291343c349b7cc4c4f018f8940b8ecc6ebc1

SHA512
0416e18d659e16f45425a930499e6b50f1dad669878a406ae6293395ed8cbed1359e91c998d12549ab13670203748e46215fa3c954de467f2b7e699e7f8a9f71

Download Submit