b92c73fd80d0356057d3b279d18e2ef7097eae67d0bf0ee03478f0bb19bef23c

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

selfbot/data/favorites.json
Size

23B
MD5

fc57d0ad344261ac76a6dc174e792bbc
SHA1

a202dd1d3088d04bf771f0bb3a25141578a6eafb
SHA256

48f0a7000731c3420f255f0dd965fa361dd91a36fb961e5c673aceb8edba7a98
SHA512

e500e0fc49d0679d1b33dedd70d88599ab7d8fce87a94bc2750aee935db68b85b16c755a3ea9ebb149c164a1167c5ab8283c8ec7c89789e936f7e48b302fa519

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\json_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2300	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2300	AcroRd32.exe
2300	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2656	1876	cmd.exe	29
PID 1876 wrote to memory of 2656	1876	cmd.exe	29
PID 1876 wrote to memory of 2656	1876	cmd.exe	29
PID 2656 wrote to memory of 2300	2656	rundll32.exe	30
PID 2656 wrote to memory of 2300	2656	rundll32.exe	30
PID 2656 wrote to memory of 2300	2656	rundll32.exe	30
PID 2656 wrote to memory of 2300	2656	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\selfbot\data\favorites.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\selfbot\data\favorites.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\selfbot\data\favorites.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
23d0180879b040489f08e5541add3925

SHA1
f023e3178730e6c220c34c14a3be509619033960

SHA256
b816bb6481e34c1462c669b848379a20c878ed07d66926053dc82556008446ad

SHA512
fdd6f0dbc093baca7420ff036500fc81ca84fae4b96bf8a5bad72c4cb5ca70cf625502f1fdfe9647c16ee04f849adb55ce066d5bf6d5452b28597deaecfaae27

Download Submit