1b8dbedf6136cd2c742daba48bcecd584421a4456a78f7b907cadd4f76e5e90b

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 03:58

Target

triage/config.json
Size

8KB
MD5

a6ba7b662de10b45ebe5b6b7edaa62a9
SHA1

f3ed67bdaef070cd5a213b89d53c5b8022d6f266
SHA256

3f7518d88aefd4b1e0a1d6f9748f9a9960c1271d679600e34f5065d8df8c9dc8
SHA512

7fc9d4d61742a26def74c7dd86838482e3fc1e4e065cb3a06ae151e2c8614c9c36e8816ae0a3560ad5dd3cc02be131cb232c7deacc7f7b5a611e8eec790feea1
SSDEEP

192:DLxgpmWU6ig4HJmLDHqlexR4qjIuoIyig4H8mLDHs:D1IhU6ApmZrIoyAcmM

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\json_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2784 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2784 AcroRd32.exe
2784 AcroRd32.exe

pid	process
2784	AcroRd32.exe

pid	process
2784	AcroRd32.exe
2784	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1640 wrote to memory of 2716	1640	cmd.exe	rundll32.exe
PID 1640 wrote to memory of 2716	1640	cmd.exe	rundll32.exe
PID 1640 wrote to memory of 2716	1640	cmd.exe	rundll32.exe
PID 2716 wrote to memory of 2784	2716	rundll32.exe	AcroRd32.exe
PID 2716 wrote to memory of 2784	2716	rundll32.exe	AcroRd32.exe
PID 2716 wrote to memory of 2784	2716	rundll32.exe	AcroRd32.exe
PID 2716 wrote to memory of 2784	2716	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\triage\config.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\triage\config.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\triage\config.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2784

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1f060073e1048c429074937d5def1d4a

SHA1
644409ea14077016ecc379bc2d7ed32c14f502d5

SHA256
3cf588689fac3d42f99a8fad792be47a3ee2ffc4ce103621cca9773a0ed7ef64

SHA512
83ee8c63b67f3d67cb2d111481438cfcb993876857369a529902f36f4ec0d477bf87f6bad2c8c7c7585c510a24a8207d73b2c1dc04db9de5845e015e4d13caa8

Download Submit