e170285b4b35ce0bde78ed868748f64893704e57f49bcd69a540fbedbf05f69e

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/minecraft/atlases/paintings.json
Size 146B
Sample240709-xtytbazfpn
SHA256 1c41b5229711058c28c99960ac54dac72b7e361a59779e3f2ed9a082d82ce57d
MD5 7d9bfc056e7f041632f45fa2bfd2286a
SHA1 55374bf8c0bdad2c11d6f80e97bee8eef751ef50
SHA512 0ffcb0ebe1d204718989c9101e48875bf5d773dfc8e353215bf44bf7f02879144ce399a33160451fa5873d5a17f6f68bbb3f95723ef1d1855a5bc1cb0bcbfcc0
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2280	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2280	AcroRd32.exe
2280	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2408	1628	cmd.exe	29
PID 1628 wrote to memory of 2408	1628	cmd.exe	29
PID 1628 wrote to memory of 2408	1628	cmd.exe	29
PID 2408 wrote to memory of 2280	2408	rundll32.exe	30
PID 2408 wrote to memory of 2280	2408	rundll32.exe	30
PID 2408 wrote to memory of 2280	2408	rundll32.exe	30
PID 2408 wrote to memory of 2280	2408	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\paintings.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\paintings.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\paintings.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 8de793f620430dfd31edf06b7a302f55eb1ea0cafe4a6537e93512bf7e26f844
MD5 65aa5d56b4f459edd04ad59031e7dfa8
SHA1 33b094ee7689e20c6c02cf26eaf8ca194845692c
SHA512 cf2b021b49934bb82ada17b695c02b2abbec68b9044c5e12f77c0b209bca8bdd416c164e95545d122e86a1c92ed8eb89ec2d04e9d92ef0e6566a40904d927870
MD5 SHA1 SHA512

Submit Download