0ff0224edb6a27b5c23adc7fb759864bb3c645f2cf2f38d0a0290c1fa691fdd2

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WaveTrial/data/settings.json
Size

302B
MD5

801b80146dc98d71f1e858ecb80a0ffb
SHA1

e81e181133354fd8c83a58230e71887dbe406219
SHA256

6aca09ff0ab2488bd827b04d268f0be01427c4bd42b8e457bf1b67b2d968b388
SHA512

72dbeea7f9200824e91d08d859b758a897803bc0d8aabf00e8de43bb743c38c2fff30a59402c0a905e5cff6a9a9d4da339b3280a1405770e2757beaf0e716f0c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2804	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2804	AcroRd32.exe
2804	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2728	2288	cmd.exe	29
PID 2288 wrote to memory of 2728	2288	cmd.exe	29
PID 2288 wrote to memory of 2728	2288	cmd.exe	29
PID 2728 wrote to memory of 2804	2728	rundll32.exe	30
PID 2728 wrote to memory of 2804	2728	rundll32.exe	30
PID 2728 wrote to memory of 2804	2728	rundll32.exe	30
PID 2728 wrote to memory of 2804	2728	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\WaveTrial\data\settings.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\WaveTrial\data\settings.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WaveTrial\data\settings.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9b0f1c298516ac47c7e6cc94511be3e1

SHA1
d0e83f71a04b52b48c96b8549a2cca4b8d9984c9

SHA256
7a65e4eda2c321fbac7f007a23316cc486a1a43eecb91f8d997e1299753fac3f

SHA512
7b12bd85bc629e06b4f688a611ebfa0142e8b9bb5a1fdec90540bbabf14fca15f4c17da2c32435e98e84c767d7b625a61ad40ea5d9b529b577aa038e90efc9b1

Download Submit