Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/05/2024, 06:27

General

  • Target

    jodit-react-main/.gitignore

  • Size

    56B

  • MD5

    77a03d6f07a476013d36d003457189c7

  • SHA1

    6aa2c5f7b62ce0f18d1602cc3bc7638fbb217c97

  • SHA256

    bc8dfafe08bd67c860dae7474fa392ccb314987e7644dd3daaa0529e0462c61f

  • SHA512

    3b559d81a307b60c3b4ed04be86b3e3dc8a8305d738ebe35f3b4d5d222934e0cc5f729ec645befdc27f8ea902db24ae85fc547cbf7aa7c765eb293ed910f70a5

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\jodit-react-main\.gitignore
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\jodit-react-main\.gitignore
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\jodit-react-main\.gitignore"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    9e65fbb11cbf1923bb75a8d1dd865471

    SHA1

    e38955d729c1e716c0818220b43dab1159a2a4bf

    SHA256

    0bd981ed451dc1effb0a8c176bd8acd58a6de85e437cb3c052df9f0a511fe747

    SHA512

    259981067c3c6d22f2760207aaadc5a5ef4b4cf1c90fdf0fb8f86e74a6dfe07e557f65296b70817be725e9310b0abe6fc94fd955aad75d65997ad085b3cba876