df351abb70d45df91fb90f9f22667e7da8d93af121c2d21e8aa2e8155909df88

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jodit-react-main/.npmignore
Size

75B
MD5

94f7091f03be5de45c59b9e4b5c9453c
SHA1

45b2da1becf5d8536e99e83467b18230b52db866
SHA256

bd136112d62cb829be627a449507c831899c6e3396afd67880dd59fb9b68b603
SHA512

a9b175cbee1de9b2eaf8ebe8db45c1de951933a6753f8a754a5adcd8f6333a078a51c85d1a46e931f69e5f3b7339a58862d0cb0f6bac5396efd987a307322d46

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\npmignore_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\npmignore_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\npmignore_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\npmignore_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\npmignore_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.npmignore	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.npmignore\ = "npmignore_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\npmignore_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2592	AcroRd32.exe
2592	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2596	2964	cmd.exe	29
PID 2964 wrote to memory of 2596	2964	cmd.exe	29
PID 2964 wrote to memory of 2596	2964	cmd.exe	29
PID 2596 wrote to memory of 2592	2596	rundll32.exe	30
PID 2596 wrote to memory of 2592	2596	rundll32.exe	30
PID 2596 wrote to memory of 2592	2596	rundll32.exe	30
PID 2596 wrote to memory of 2592	2596	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\jodit-react-main\.npmignore
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\jodit-react-main\.npmignore
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\jodit-react-main\.npmignore"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
343ae2fc6fb89e2a26eb7a45957d4dcd

SHA1
c164235cf664681a6ef09909015e0284a2da1d5c

SHA256
bdca429c3618047b7bc32a54cdf45ecf8c598f388c3fd0858d1954524d7303bb

SHA512
b5563c46b46d5fc2d4ee059da328a4ba2a59d761b4b74856cca3d3e8885747090f265c83d18c6858b1a969f1ec8f55d50b987da4e1ea5608e469cc7a0ed39062

Download Submit