e170285b4b35ce0bde78ed868748f64893704e57f49bcd69a540fbedbf05f69e

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

assets/minecraft/blockstates/acacia_door.json
Size

4KB
MD5

4d0d371d7efc7454b54bd1fcc379620e
SHA1

22aff211ea70e395ac3275d6171ab03ce6385216
SHA256

a06e0262c6139d5785ac5b4f09adefb9028eb36c10e79695f244884a802f364c
SHA512

85b22268a63e11346cb49ee2df82e26f938e41a4e2ae0994c4566fd3a0879ba3f3cf78e5209ad0e5bd787cf27c278516fdc94741feba545b6e6475ea8872696a
SSDEEP

96:tUOUDUPUxUVUwUyUMUGU5UnUvU5UOUeUoUyU7ULUBUFUMUiU8UwU9UxUjUzUyUwX:thkumcBJjLKQGOHjX54mMkNhNr4wS+d7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.json	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2932	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2932	AcroRd32.exe
2932	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2112	2516	cmd.exe	31
PID 2516 wrote to memory of 2112	2516	cmd.exe	31
PID 2516 wrote to memory of 2112	2516	cmd.exe	31
PID 2112 wrote to memory of 2932	2112	rundll32.exe	32
PID 2112 wrote to memory of 2932	2112	rundll32.exe	32
PID 2112 wrote to memory of 2932	2112	rundll32.exe	32
PID 2112 wrote to memory of 2932	2112	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\blockstates\acacia_door.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\assets\minecraft\blockstates\acacia_door.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\blockstates\acacia_door.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e1d2228e76f14649fcafe1dccfcbfee7

SHA1
c5147ddbd32610e0aa07c41a10f1b9b327dae253

SHA256
a278d2f3546c38f23552cfeab93d22447a8235a299b1d4e536129ff8aad5107e

SHA512
97fbceed0c4b1bb629777ac31ed0925da71ed4d0f2994dd5921d4fff4b220456d78f24aef09c538d367818ffa9cfefc3bea4e5c5e2c045b0b69e726365483746

Download Submit