1cb679bb9efcfa98fec65b5e9d85566f0d05d72aca93a9046298ac4d726f9653

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240508-es
resource tags

arch:x64arch:x86image:win7-20240508-eslocale:es-esos:windows7-x64systemwindows
submitted
11/06/2024, 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aseprite-v1.3.6-trial/data/extensions/adigunpolack-palettes/aap-micro12.gpl
Size

751B
MD5

8d8db6c197de906ce24e891557738c5e
SHA1

9452092040bd722a22160710136c98bb0a4a9f12
SHA256

df3bad3c2290bde4d06d52f9f0376522412ddbf68b4508db90989b2ef87e8d9f
SHA512

e84f236c9a14902d6d943d01cc35c1d0128fc5cf925e5ec3e85b0ba639acfe2fb6507d4217d8860769967cf27c0e33a1b143771f4a90beabb56100c403dae3ae

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2608	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2608	1888	cmd.exe	29
PID 1888 wrote to memory of 2608	1888	cmd.exe	29
PID 1888 wrote to memory of 2608	1888	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Aseprite-v1.3.6-trial\data\extensions\adigunpolack-palettes\aap-micro12.gpl
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Aseprite-v1.3.6-trial\data\extensions\adigunpolack-palettes\aap-micro12.gpl
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads