Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09/07/2024, 19:09

General

  • Target

    assets/minecraft/atlases/beds.json

  • Size

    159B

  • MD5

    f2ff764119d689cdc9eb247cb2eb0e88

  • SHA1

    dc48a3e87945b09e24a016d55d1625e5521c1b6b

  • SHA256

    1f25c5edcb0a9e53a203deece050e13aba470a16495f3e9501866e305e62a449

  • SHA512

    e9787921b28a4a73e3651b5b9c788ac02ab5dbdb7644b3d57627ad12851ffffa5fda326ea1cec6fc162e710733f41eee4bb02dbf674b1e379c2fe031fd00eab1

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\beds.json
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\beds.json
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\beds.json"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    022ffa6efa515bf92f92d4da130f7721

    SHA1

    bed8192aba52b52f7fb49ee969a0d055655617fc

    SHA256

    87197936906113ce70af55c2cf856b74a0644cda6874eb09b91dbc4aa17d4d9a

    SHA512

    8fd6c97a6bdabf3edb640492039374ade119495347ab380e31de4ce5b5ec876a3e39e53942dca3fbd71754c91dc3ef1133dfdbcb23ac2fe899214a98efcde266