ace56fea4b7af878e92fa3caa903c1dd21e0b3b43c96ba114e682afa1c2413ed

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:18

Target

Blank-Grabber-main/Blank Grabber/env/Scripts/config.json
Size

1KB
MD5

b03ab3cabcf6a8ea83ea00b43a50c1ea
SHA1

dbcf41071de87bb9f0183a012287aa80ea018020
SHA256

e02340f0d10a013946cfd22d73230104a9d88544315271bf6b9e617f3aa3dab1
SHA512

cfd15bf539cf4c7661e223d005ce67e160b6c16dafd4c0104cde3b2872a3e710dca02270fa2dc0f061998927bbbcd76711553958005da58a281fad1a649f8ff6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2016 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2016 AcroRd32.exe
2016 AcroRd32.exe

pid	process
2016	AcroRd32.exe

pid	process
2016	AcroRd32.exe
2016	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2880 wrote to memory of 2396	2880	cmd.exe	rundll32.exe
PID 2880 wrote to memory of 2396	2880	cmd.exe	rundll32.exe
PID 2880 wrote to memory of 2396	2880	cmd.exe	rundll32.exe
PID 2396 wrote to memory of 2016	2396	rundll32.exe	AcroRd32.exe
PID 2396 wrote to memory of 2016	2396	rundll32.exe	AcroRd32.exe
PID 2396 wrote to memory of 2016	2396	rundll32.exe	AcroRd32.exe
PID 2396 wrote to memory of 2016	2396	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\env\Scripts\config.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\env\Scripts\config.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\env\Scripts\config.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2016

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2adecbe11429ab0fa9290ed39d6777d4

SHA1
0c857195a2b31b9dded3e43a4e37361a10336dce

SHA256
0c012c066e4c5034353a8f6fbe0f3a07f6c5ac5d47554c94407248c11419613d

SHA512
6f7f41ccf70603df70204a5cf62a92a7cb9ca1ec5176a9c90893015ccfc7d3e9c92ef541e92059ed74f96b389c1b93c4d60b94b89af4c0193cf99d13d3eb6375

Download Submit