Overview
overview
3Static
static
1tampermonk..._1.zip
windows7-x64
1tampermonk..._1.zip
windows10-2004-x64
1LICENSE
windows7-x64
1LICENSE
windows10-2004-x64
1_locales/a...s.json
windows7-x64
3_locales/a...s.json
windows10-2004-x64
3_locales/b...s.json
windows7-x64
3_locales/b...s.json
windows10-2004-x64
3_locales/c...s.json
windows7-x64
3_locales/c...s.json
windows10-2004-x64
3_locales/d...s.json
windows7-x64
3_locales/d...s.json
windows10-2004-x64
3_locales/d...s.json
windows7-x64
3_locales/d...s.json
windows10-2004-x64
3_locales/e...s.json
windows7-x64
3_locales/e...s.json
windows10-2004-x64
3_locales/e...s.json
windows7-x64
3_locales/e...s.json
windows10-2004-x64
3_locales/e...s.json
windows7-x64
3_locales/e...s.json
windows10-2004-x64
3_locales/f...s.json
windows7-x64
3_locales/f...s.json
windows10-2004-x64
3_locales/h...s.json
windows7-x64
3_locales/h...s.json
windows10-2004-x64
3_locales/h...s.json
windows7-x64
3_locales/h...s.json
windows10-2004-x64
3_locales/h...s.json
windows7-x64
3_locales/h...s.json
windows10-2004-x64
3_locales/i...s.json
windows7-x64
3_locales/i...s.json
windows10-2004-x64
3_locales/i...s.json
windows7-x64
3_locales/i...s.json
windows10-2004-x64
3Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 18:31
Static task
static1
Behavioral task
behavioral1
Sample
tampermonkey_5_1_1.zip
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
tampermonkey_5_1_1.zip
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
LICENSE
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
LICENSE
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
_locales/ar/messages.json
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
_locales/ar/messages.json
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
_locales/be/messages.json
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
_locales/be/messages.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
_locales/cs/messages.json
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
_locales/cs/messages.json
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
_locales/da/messages.json
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
_locales/da/messages.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
_locales/de/messages.json
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
_locales/de/messages.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
_locales/el/messages.json
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
_locales/el/messages.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
_locales/en/messages.json
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
_locales/en/messages.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
_locales/es/messages.json
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
_locales/es/messages.json
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
_locales/fr/messages.json
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
_locales/fr/messages.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
_locales/hi/messages.json
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
_locales/hi/messages.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
_locales/hr/messages.json
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
_locales/hr/messages.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
_locales/hu/messages.json
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
_locales/hu/messages.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
_locales/id/messages.json
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
_locales/id/messages.json
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
_locales/it/messages.json
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
_locales/it/messages.json
Resource
win10v2004-20240426-en
General
-
Target
_locales/da/messages.json
-
Size
42KB
-
MD5
83d39c452b2b02dd1122a5bb83070585
-
SHA1
66066942fdb7c65c54494ca872475c69747d4dbf
-
SHA256
932cf6b02aa403785b5d7d69b6e4954e9161b4389133131a7e96dc15c355a2d1
-
SHA512
4f045b622166844ad0b670cf940a4181412deb35c152c7eadb3f60b4cc07e63bb281e3ef945fea91c4630efc7af611a26d17d21022d87f817a72af56357a5004
-
SSDEEP
384:unVNfMUodUTkPdMoU0aP6ro8By/1f+PDLrHFkDj++tW2mZE3VdLZwz/JN3FdSYM:gIUTSMot71bXZ2eeVxZYyYM
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.json rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2996 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2996 AcroRd32.exe 2996 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2612 wrote to memory of 2576 2612 cmd.exe rundll32.exe PID 2612 wrote to memory of 2576 2612 cmd.exe rundll32.exe PID 2612 wrote to memory of 2576 2612 cmd.exe rundll32.exe PID 2576 wrote to memory of 2996 2576 rundll32.exe AcroRd32.exe PID 2576 wrote to memory of 2996 2576 rundll32.exe AcroRd32.exe PID 2576 wrote to memory of 2996 2576 rundll32.exe AcroRd32.exe PID 2576 wrote to memory of 2996 2576 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\_locales\da\messages.json1⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\_locales\da\messages.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\_locales\da\messages.json"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b1fe1f5a18e0d77b40bc7535bc1c644c
SHA1116c1fc4d0a075d8fa3a7fba5a25a57b49bf607b
SHA256e382fa8221b58c121d4943769fbe778904c6bc1c9c8331f351cb377adc99896e
SHA512742830d54ad7b021c88ac958b011b45cb7df50cb6783403aa8ac325ba29035b321f605cc45cd46096951ca4956576bb1e2b9d17021d9e1e43b452513235502a4