0f931ef68b73d54c7badb15ce19ffe79a9ebb6489ecf86a808cd57b3874404d2

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_locales/el/messages.json
Size

54KB
MD5

8a28c0906de7c1ef50e723c31a0e0305
SHA1

19156e4de35ce5ddc7c69f12157cab55df93c714
SHA256

bbcdcfe9a64c770ec280f074c4cf03551761081347d57499058458f707af0f1b
SHA512

48065d120a163d9cc3d67a5e22c60b9807ce7b828e8e0585126d1fa66e904f02733f883c080efc3170f618db65146ea3c851200e7ac16ea5d0aac12a98912818
SSDEEP

1536:J/Cx23WZdsF1rOBpS4FyjmAEYhnvkCCyvrp6imbhLaEOUtJ+:J6ZNmnxlqt7+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\json_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2572 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2572 AcroRd32.exe
2572 AcroRd32.exe

pid	process
2572	AcroRd32.exe

pid	process
2572	AcroRd32.exe
2572	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2236 wrote to memory of 2716	2236	cmd.exe	rundll32.exe
PID 2236 wrote to memory of 2716	2236	cmd.exe	rundll32.exe
PID 2236 wrote to memory of 2716	2236	cmd.exe	rundll32.exe
PID 2716 wrote to memory of 2572	2716	rundll32.exe	AcroRd32.exe
PID 2716 wrote to memory of 2572	2716	rundll32.exe	AcroRd32.exe
PID 2716 wrote to memory of 2572	2716	rundll32.exe	AcroRd32.exe
PID 2716 wrote to memory of 2572	2716	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_locales\el\messages.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\_locales\el\messages.json
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2716

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\_locales\el\messages.json"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2572

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
4b24726c7350b2837688c17508e9a875

SHA1
2ee4884c7db2b28a6bc45fe0bcee391c0d8551ae

SHA256
2cbc90b9361f0cf204bdad5bd0c5b16f5aa7c1176b644d43a7f914a1856b685e

SHA512
a4b0c88006e84e02b94f06396775415e735654c25ecb3ea4f5d19dee8229d0b72c32be2714f88c6a2bc7f3df66c46c17ac89f4a38c7744dd3db18c4928beda31

Download Submit