e170285b4b35ce0bde78ed868748f64893704e57f49bcd69a540fbedbf05f69e

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

assets/minecraft/atlases/signs.json
Size

163B
MD5

27e763752e211df1b4fea5fd52cbb6a2
SHA1

df7359c549db0b6f568c094fd86079b3e5acfde8
SHA256

846e68672fbecab4d24fedeb8b49e856cb1fb2350f18f1901df5e71c2fed56e9
SHA512

ebfe20a446350a4debb8c5c31712709de3300496ef41bcf73f30428b7ab970a0a9f3faa8d6005f4930abbf4f3248d7f8f91d38d2c605f7c17866e64bc723357b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\json_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2204	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2204	AcroRd32.exe
2204	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2672	2900	cmd.exe	31
PID 2900 wrote to memory of 2672	2900	cmd.exe	31
PID 2900 wrote to memory of 2672	2900	cmd.exe	31
PID 2672 wrote to memory of 2204	2672	rundll32.exe	32
PID 2672 wrote to memory of 2204	2672	rundll32.exe	32
PID 2672 wrote to memory of 2204	2672	rundll32.exe	32
PID 2672 wrote to memory of 2204	2672	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\signs.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\signs.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\signs.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
203d862571cef127b0897a0ed4c451b0

SHA1
7629079c0c4ebe55f260f288c03f5527a50794d3

SHA256
85cd1c0658caf739cdbcbb03233e4f3605d4cdd0cb8effbca7d8d6005f60ec2f

SHA512
832730d2686f7cd5565b6a0c62db598aec8c65c4765e395a05415334b38b2bcaa2df5e71044a3d0d69f8a2bce4ca2101ea45f6c012613302e00572bd698ca903

Download Submit