1cb679bb9efcfa98fec65b5e9d85566f0d05d72aca93a9046298ac4d726f9653

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-es
resource tags

arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
submitted
11-06-2024 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aseprite-v1.3.6-trial/data/extensions/arne-palettes/arne16.gpl
Size

591B
MD5

535d27c45d6f646b284db9aa1183f28c
SHA1

b5ac45115f60076c3b5a404453100c869dd474ec
SHA256

c0238f15fc189c589eb99cf7331a6681a25503acabb5138f3e5a71d8249ddc8d
SHA512

f8a075d68acfa9597099b51fb091183aeeec90ab6cc685adbcc73f2ea837ccb35fe3f0b826402aa4c3c3f3145bae66433492594ae22de6007bd76a92a6175114

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2592	2264	cmd.exe	29
PID 2264 wrote to memory of 2592	2264	cmd.exe	29
PID 2264 wrote to memory of 2592	2264	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Aseprite-v1.3.6-trial\data\extensions\arne-palettes\arne16.gpl
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Aseprite-v1.3.6-trial\data\extensions\arne-palettes\arne16.gpl
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads