e170285b4b35ce0bde78ed868748f64893704e57f49bcd69a540fbedbf05f69e

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

assets/minecraft/atlases/banner_patterns.json
Size

265B
MD5

a4a5344cca1d1bf5b4162b278965ee41
SHA1

f764d4b8f286b102e35f2c2e41c3dc1f4724bef5
SHA256

2f159e399b91409dc3c0e97f2dc1437edc8fbb7c5585900423da782bf09f01e1
SHA512

29068e5ba8393be51a21c445192b6bab89b92a3416e888a2043fa2aa90620bf78085c4be6dc73863668e7de0efbb1a64d9b86e88651ac1ae8e52f5764f5def30

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2564	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2564	AcroRd32.exe
2564	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2964	2668	cmd.exe	32
PID 2668 wrote to memory of 2964	2668	cmd.exe	32
PID 2668 wrote to memory of 2964	2668	cmd.exe	32
PID 2964 wrote to memory of 2564	2964	rundll32.exe	33
PID 2964 wrote to memory of 2564	2964	rundll32.exe	33
PID 2964 wrote to memory of 2564	2964	rundll32.exe	33
PID 2964 wrote to memory of 2564	2964	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\banner_patterns.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\banner_patterns.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\banner_patterns.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
29ee919401baa33961fc991fe04189c2

SHA1
8f9ee8ec6c6c67ffd547998cfb9ee8c54586da25

SHA256
b03d541f49b94188311007d4e4b96a675edd942682e559d183bec532d45dce9d

SHA512
98036c33cf17682332e2a83028a1f502da3f028103a9da6429928fe2cd5de116f0146ce054ddb8a136a76d7e892990c2d48b5f2894353f599687e52b93726d53

Download Submit