e170285b4b35ce0bde78ed868748f64893704e57f49bcd69a540fbedbf05f69e

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/minecraft/atlases/chests.json
Size 163B
Sample240709-xtytbazfpn
SHA256 3d69e5bbfa822372bdb4b4066fa1a76d9929883b3c58684b49a3bfc8dbe9eb33
MD5 f45259e2f7c6ce907d80d7d4bcfbe6a0
SHA1 aa4c883f15443d8bb6efd1c9e05e32054d1d19d3
SHA512 fe60d40e3e1e67734d106088127fd6ded6b2826933902df88cd47b0651e0accb75d4124b06239f91b78b1f32a19e0cb84fec8bbefc329d5bf1beed660ab15261
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2832	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2832	AcroRd32.exe
2832	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 580	2220	cmd.exe	32
PID 2220 wrote to memory of 580	2220	cmd.exe	32
PID 2220 wrote to memory of 580	2220	cmd.exe	32
PID 580 wrote to memory of 2832	580	rundll32.exe	33
PID 580 wrote to memory of 2832	580	rundll32.exe	33
PID 580 wrote to memory of 2832	580	rundll32.exe	33
PID 580 wrote to memory of 2832	580	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\chests.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\chests.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\atlases\chests.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 b6e6094ed68cb36a54e094a0bc49eee29bc4813e7db67d4d4df1e7dcac3f3df2
MD5 0f4abba4af004e834b91dae6f753bab8
SHA1 69eaafb15255e38aa013ab742b6bab09965053ba
SHA512 c8a7a7ca568673f793858d84cbe2ea8743e38ef3a7659ff6f7ea7e1ee8b7b6c2f7bb35ad2e3f5c1c74256a7e7e1bde1ca716adec4c66eb9bf2b838ca478d9f0e
MD5 SHA1 SHA512

Submit Download