79e3037e9a06e020f071e87180d44e82e8f12067351c6ef6258d6d80afbce090

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MHDDoS-main/config.json
Size

9KB
MD5

8d423ba956cd1e7e0b7bd0991929a82e
SHA1

0e5e721ccc4aa9ac6e15f20f5da740e7ff23e547
SHA256

5cac735dd0454982dacf3a3366560788fe1ca675c1a264e198b7dbabe390ab83
SHA512

59c98964a3f7802d81087671dbe86d5e6345462f875c2da57f044e4dac5f053b441e6c839a56e451d42e9b9fa2776bedfe849f610023d63d8b9f0cd23589e4c7
SSDEEP

96:d3vsmTw3KMk0Tow3b3/9xUImKSQ0Tc6Tgap2V9oKhIF:JcKMD7FxjmK8t23hU

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2752	AcroRd32.exe
2752	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2628	2104	cmd.exe	29
PID 2104 wrote to memory of 2628	2104	cmd.exe	29
PID 2104 wrote to memory of 2628	2104	cmd.exe	29
PID 2628 wrote to memory of 2752	2628	rundll32.exe	30
PID 2628 wrote to memory of 2752	2628	rundll32.exe	30
PID 2628 wrote to memory of 2752	2628	rundll32.exe	30
PID 2628 wrote to memory of 2752	2628	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MHDDoS-main\config.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MHDDoS-main\config.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MHDDoS-main\config.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e43107d5f4f4688c40f8624c0dc6206c

SHA1
c56ff2646de26517b9cbf5e397b484c744e24fc7

SHA256
aef65f70f98ca25166ad1dffd782c8e059eceea52e379f2fe76675a7a7a6217b

SHA512
6cbd574ad00357424630307de99b2ccaa3bf2663e2a96908cbe7b36625fa166196fd482e63d6c75dca7ce7071fc47bc41471277667c36cdd0fec2386e3a29bb3

Download Submit