981eeb419fd3ac1a7701cebe39149c89c8ba22a389936e93b3984d9640fdfad8

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

art/sound/blends/7264393240D9A7C048B7E98A2DCCBFA4.sfxBlend2D.json
Size

5KB
MD5

bc81d2e48b9e77187c08f55c56541430
SHA1

cdb31294dec7a7092b01b05e685fb75900801c99
SHA256

3c22ba184f4715ec05d083cd917f78999ac82370439269cb5f4f695661b8e4b5
SHA512

795a38e70fa7f27f3ef13941a609140384ab166314034c20778ee954e7c3d4e5f37af5f604abdaf325ac8b6e50d19d77e15b471e55bf5608ba6deca516963dec
SSDEEP

48:FRexTy4b4n4Vp9qXStZG5n8XHsM90En/hhY:FwxTyJStZG5d05u

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1992	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1992	AcroRd32.exe
1992	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2644	1628	cmd.exe	29
PID 1628 wrote to memory of 2644	1628	cmd.exe	29
PID 1628 wrote to memory of 2644	1628	cmd.exe	29
PID 2644 wrote to memory of 1992	2644	rundll32.exe	30
PID 2644 wrote to memory of 1992	2644	rundll32.exe	30
PID 2644 wrote to memory of 1992	2644	rundll32.exe	30
PID 2644 wrote to memory of 1992	2644	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\art\sound\blends\7264393240D9A7C048B7E98A2DCCBFA4.sfxBlend2D.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\art\sound\blends\7264393240D9A7C048B7E98A2DCCBFA4.sfxBlend2D.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\art\sound\blends\7264393240D9A7C048B7E98A2DCCBFA4.sfxBlend2D.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c4930fe5ff26b493ea8fd647ee6a3fbd

SHA1
a5eb5b8f6179883d9f1ccaccf4eb3841e2e79ccf

SHA256
84d6b8dc4878658a5b278bde8ee88e3099d8ae4abab4857d38a30d547623dcc8

SHA512
6af5568cf9c8b19ae74da54f2bb2e3736c93781f903a9feb03c4e9c11df42d491fd24c06819928e6f40dcdfec8730b6915233eaf6bc587345aa57ff664f02686

Download Submit