0f931ef68b73d54c7badb15ce19ffe79a9ebb6489ecf86a808cd57b3874404d2

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_locales/hi/messages.json
Size

49KB
MD5

08dca91638f7f5c5d39bd655aa884a0f
SHA1

98510acd8f9d02233c6dfc0bf9093df0eab76bd3
SHA256

a882aa7c0b3f2bf590d88265f7e95f208b42c4846b88d4dddb69608e04ab87d0
SHA512

373c2cc5491a222138b654cda413a0208dff3d99f1402a68172915c6cc9cda9ce9394ba441fa57b0911171584a3d818ac184487bcefcbc9e40ede561e3e5c0bd
SSDEEP

384:PkWfLtERFEgbf/Af+QKmR3kE4ggRSVrcemNTl15B/jtzGVYwcB1yXwAzlrOrrE7y:qFhippuDjJd3IuQnfqiAgBVvlx+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2636 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2636 AcroRd32.exe
2636 AcroRd32.exe

pid	process
2636	AcroRd32.exe

pid	process
2636	AcroRd32.exe
2636	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2452 wrote to memory of 2524	2452	cmd.exe	rundll32.exe
PID 2452 wrote to memory of 2524	2452	cmd.exe	rundll32.exe
PID 2452 wrote to memory of 2524	2452	cmd.exe	rundll32.exe
PID 2524 wrote to memory of 2636	2524	rundll32.exe	AcroRd32.exe
PID 2524 wrote to memory of 2636	2524	rundll32.exe	AcroRd32.exe
PID 2524 wrote to memory of 2636	2524	rundll32.exe	AcroRd32.exe
PID 2524 wrote to memory of 2636	2524	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_locales\hi\messages.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2452

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\_locales\hi\messages.json
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2524

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\_locales\hi\messages.json"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2636

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
ef54f5b523a785354db741b79ec02789

SHA1
ca5a5fa87c59ed8c986249609cd6eaa2a83903ae

SHA256
0c708893ae60f86c3346198d09b209785508a34c8f010719f04a04c4ec909f7b

SHA512
3267f56c8a4e226e82f281f3d152253b26b73b65944bb450b660e7c160c52266ffd52817256e46751bfd49e07a676f9fffe720d57635f97cd729258313cb9101

Download Submit