a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app/node_modules/child_process/package.json
Size

295B
MD5

c913f6d16eb753431d36ea482cacb065
SHA1

5cb1c8bdc60101846714e942758d888a008120e4
SHA256

104f06b6ce2e379c3bb02cdfc1918edd3ee45e1fb3c8b5c4dcd0ab122675a964
SHA512

ebbc2aa93b22df1e8cec1889022c9f7e54cf5dbdbe6568ae39c3cd355aaab154b9b8197238682dc36143fe5fe2d25f936adb21f5101dcb5aa6570eaa8ec35ade

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.json	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2956	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2956	AcroRd32.exe
2956	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2712	2028	cmd.exe	29
PID 2028 wrote to memory of 2712	2028	cmd.exe	29
PID 2028 wrote to memory of 2712	2028	cmd.exe	29
PID 2712 wrote to memory of 2956	2712	rundll32.exe	30
PID 2712 wrote to memory of 2956	2712	rundll32.exe	30
PID 2712 wrote to memory of 2956	2712	rundll32.exe	30
PID 2712 wrote to memory of 2956	2712	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\resources\app\node_modules\child_process\package.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\resources\app\node_modules\child_process\package.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\resources\app\node_modules\child_process\package.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1cd7add9c0b8ddeb5dde98beabe093aa

SHA1
a756e718e3feec4f07325a6e09a92ba0a31e512a

SHA256
7e3a6fdce4b473974025005609ce62f116f3f3f4982da532bf5547d4149294a8

SHA512
32730dde9c1840ed83f48fc2396c2796e226b4b0867a6494d49a9dbe49858472319083c774c6bd532e3590a1b424c13194c3c142ae0eb646ee97752bb8080129

Download Submit