670c3c11677386167bdc685d2a25a97751ffef4c89ddacc230af2d7021b8200b

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07-06-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

net8.0/Spoofer Base.deps.json
Size

1KB
MD5

6505f505d9826ce6a4a8eaa049e9c1a1
SHA1

0f1e89fc96dcdc109b4cd891de1baa6f5bdf0c4c
SHA256

287819587c448f925431384eb750f2dfeb6d2570757553512ef615b2060fbe86
SHA512

740765d4b1f04016af01b0795ab8f247f956d3035ebe0a343df5be480113333361a37c90040758253b5ce01494f740d2f6e55ef38e43a280c90aa4c073f3e176

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.json	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2336	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2336	AcroRd32.exe
2336	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2636	1916	cmd.exe	29
PID 1916 wrote to memory of 2636	1916	cmd.exe	29
PID 1916 wrote to memory of 2636	1916	cmd.exe	29
PID 2636 wrote to memory of 2336	2636	rundll32.exe	30
PID 2636 wrote to memory of 2336	2636	rundll32.exe	30
PID 2636 wrote to memory of 2336	2636	rundll32.exe	30
PID 2636 wrote to memory of 2336	2636	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\net8.0\Spoofer Base.deps.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\net8.0\Spoofer Base.deps.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\net8.0\Spoofer Base.deps.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
54df021ab6d463d7b89f31c8d4576ba3

SHA1
b9ad871428ff7df9219c4cbe81b27bcee8346e78

SHA256
84f421bc4f57ec999da5c69f1b571dd7d02daddbb57aa3f032039faddd9c94c0

SHA512
f45fe8d65533001ce6ed6a6ae3bca3e1e5ac1afb7aa94931fe9339dbb9558e29b1061ddf185553d7763666c7548775e3e024cbd5239e27f3c0a4216ee5f3cf68

Download Submit