e170285b4b35ce0bde78ed868748f64893704e57f49bcd69a540fbedbf05f69e

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/minecraft/atlases/mob_effects.json
Size 148B
Sample240709-xtytbazfpn
SHA256 7ae3d423a2a209f6b31dc741b80dd8ea65fe9bc2dc9924a2d80647a1763e0877
MD5 ede7b07e890dc841a5de808d584fb912
SHA1 dcd9a4bb5883d11f27dd3ac7a3193783a26fc788
SHA512 b63b9875a2bd7f68b594cf9a944fd38856774a49342e7dc2a276f789c9ec05a46153a4a24c2be262e210e82e9111002bc0f443a4357cc98c5fdf4e5b2d604bb8
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2796	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2796	AcroRd32.exe
2796	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1716	2572	cmd.exe	31
PID 2572 wrote to memory of 1716	2572	cmd.exe	31
PID 2572 wrote to memory of 1716	2572	cmd.exe	31
PID 1716 wrote to memory of 2796	1716	rundll32.exe	32
PID 1716 wrote to memory of 2796	1716	rundll32.exe	32
PID 1716 wrote to memory of 2796	1716	rundll32.exe	32
PID 1716 wrote to memory of 2796	1716	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\mob_effects.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\mob_effects.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\mob_effects.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 6f82d65aff0af47d9836cb080778d6e7f332bc6dbb7996546dd9600b5ff7f435
MD5 7776f1351b0a676a0228c5245b2e6789
SHA1 798436a1ce296ff78208924887bc1366f43d4fa5
SHA512 edf162410293b72a529c47375b02b90a5b5e3cd0a602fae6ea91bd50bff8b5b1c4fa625343eeb8a85de3f53a9e36af4bef8b9eb4f487b8308fb3043faeaaa8cb
MD5 SHA1 SHA512

Submit Download