45a32a4a46e916adfb5017ef80f07b7410f04879cd75193fedce951ba1751ced

Analysis

max time kernel
103s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17-07-2024 08:22

Target

maple/assets/config.json
Size

149B
MD5

ee9db446b33f463ca8f558873c6fff7e
SHA1

d40efe04626a430d9c9c1b8db90dbd1110d8e2f8
SHA256

09962830609b0d1d5b286ad3e178245cfc152caa278d660b5b0a3dc21559547e
SHA512

7babaeb3edf9a7fcb9da804c5c1c53ce8abfeb91f83774a60bd538ca3c0bb4afb29f0afeb4ebb00bb51575a8c8d7011900367b92643925a1e585f2e73fba86d8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2976 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2976 AcroRd32.exe
2976 AcroRd32.exe

pid	process
2976	AcroRd32.exe

pid	process
2976	AcroRd32.exe
2976	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2576 wrote to memory of 2816	2576	cmd.exe	rundll32.exe
PID 2576 wrote to memory of 2816	2576	cmd.exe	rundll32.exe
PID 2576 wrote to memory of 2816	2576	cmd.exe	rundll32.exe
PID 2816 wrote to memory of 2976	2816	rundll32.exe	AcroRd32.exe
PID 2816 wrote to memory of 2976	2816	rundll32.exe	AcroRd32.exe
PID 2816 wrote to memory of 2976	2816	rundll32.exe	AcroRd32.exe
PID 2816 wrote to memory of 2976	2816	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\maple\assets\config.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\maple\assets\config.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\maple\assets\config.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2976

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f5d06f49eade5f1532fd35c71d1d901f

SHA1
2f467b46617cec18d05bfba7b41b2b8e43606d1f

SHA256
8a5bf9d547dcfbb986ef5e0509528807f2e5ed68f156a9bb4d40fed38b23d5ff

SHA512
89fd2e04e92494dc6c30182bbd7b8201a5c076c42c46fb2c422f5a7038db8f8fe60d99fad731a0b447ce40e9f4b9c5d3be90cd8fcbda733b0eea5c4e6cc54e15

Download Submit