e170285b4b35ce0bde78ed868748f64893704e57f49bcd69a540fbedbf05f69e

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

assets/minecraft/atlases/shulker_boxes.json
Size

167B
MD5

46466c40c0a4f0248a07b23eb6f26c0d
SHA1

a4ba97632854a68f4e4840d1fa8dce3cb2e1c32e
SHA256

477ab692fcb14550cb753606e1054120bfa5e8fcbd826a0c65bd218b16852cc4
SHA512

b59ed50d2012d4c1ac7439a99f2a21926cadf7b57876e1d33868cbe3a6859d7145b84982a22393979eb8243826742770cd021712d9973783da27b549c3859c17

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.json	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3004	AcroRd32.exe
3004	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2264	2032	cmd.exe	31
PID 2032 wrote to memory of 2264	2032	cmd.exe	31
PID 2032 wrote to memory of 2264	2032	cmd.exe	31
PID 2264 wrote to memory of 3004	2264	rundll32.exe	32
PID 2264 wrote to memory of 3004	2264	rundll32.exe	32
PID 2264 wrote to memory of 3004	2264	rundll32.exe	32
PID 2264 wrote to memory of 3004	2264	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\shulker_boxes.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\shulker_boxes.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\shulker_boxes.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d13fc4480be8d0989f14d12f0cd696a7

SHA1
162e3f98c6e15edb614eaae1af97a90244e4369d

SHA256
bfec302eee7d05b8a9ef64ef4c1767a8bf379b0d936a4a9b5f1caa35ef0f75d9

SHA512
250b42b7fef114da3a84fabada5b8ff898ce8db8a41f49098d8aca1dd7c3a5fdba3f1fb653fa4716fb985d799b2b73370962c0ac8f2ff2ad12f40fa67d038514

Download Submit