8904d96a473dd52cd5255e046d47148eb27cc778395fff4f220bbb9509f643d8

Analysis

max time kernel
357s
max time network
358s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDTOIPBYR_0.runtimeconfig.json
Size

458B
MD5

07b9a30265ca4e69c7016a1b6e3ffc27
SHA1

3a4af82a2695b1423aedd8b60a5c86793c011b02
SHA256

c71152bf25e40d647b2440c5b39be157a3d356106be9d5b678ab97bb87b4e782
SHA512

efd582f8edcdba5ef48d02eee5f73d83ff35071af99b49e08e0213928568d728d0856e3b903bfcccb9237f786846cf94da83139f99e9bee86287aff2071c3f1c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2548 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2548 AcroRd32.exe
2548 AcroRd32.exe

pid	process
2548	AcroRd32.exe

pid	process
2548	AcroRd32.exe
2548	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1504 wrote to memory of 2564	1504	cmd.exe	rundll32.exe
PID 1504 wrote to memory of 2564	1504	cmd.exe	rundll32.exe
PID 1504 wrote to memory of 2564	1504	cmd.exe	rundll32.exe
PID 2564 wrote to memory of 2548	2564	rundll32.exe	AcroRd32.exe
PID 2564 wrote to memory of 2548	2564	rundll32.exe	AcroRd32.exe
PID 2564 wrote to memory of 2548	2564	rundll32.exe	AcroRd32.exe
PID 2564 wrote to memory of 2548	2564	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.runtimeconfig.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.runtimeconfig.json
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2564

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.runtimeconfig.json"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2548

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
06e4ff8d561d7eedd6ecb6388f6eab0e

SHA1
38639f7ea62292d11d50e161e7a42bfccfb70c06

SHA256
5e9fa4a68d66b5c90ff2811f3dfc944a6efb9e6f40006b1769217bdce0bd921b

SHA512
97758220c53bde0083095a77c0457659f2af44e75d2a5a089a21c47d705aafc39209792a4d654611e7643f9189bdf9604fd55d758ebdbbfceb9e5c95e5a86bd5

Download Submit