a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4

Resubmissions

19-07-2024 03:58

240719-ejs6za1hkr 10

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app/node_modules/balanced-match/package.json
Size

891B
MD5

0130280bf90eac1705fff7300dbacb2d
SHA1

6d6b92d1267c374384bac32a0a8d435b762b852a
SHA256

b4cfa3b375d23e8e979227e68db4d4ea1e810328458c78390886f2fd1df5740e
SHA512

5dec31f3125b3fe7e7b3c843839a01968778f10077d3b310beb0b767b5fd8f447ba509a4d884e31d5ec127c067b9d69715a673065a2adb619e7f56f65459f2ae

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1324 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

1324 AcroRd32.exe
1324 AcroRd32.exe

pid	process
1324	AcroRd32.exe

pid	process
1324	AcroRd32.exe
1324	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2756 wrote to memory of 2636	2756	cmd.exe	rundll32.exe
PID 2756 wrote to memory of 2636	2756	cmd.exe	rundll32.exe
PID 2756 wrote to memory of 2636	2756	cmd.exe	rundll32.exe
PID 2636 wrote to memory of 1324	2636	rundll32.exe	AcroRd32.exe
PID 2636 wrote to memory of 1324	2636	rundll32.exe	AcroRd32.exe
PID 2636 wrote to memory of 1324	2636	rundll32.exe	AcroRd32.exe
PID 2636 wrote to memory of 1324	2636	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\resources\app\node_modules\balanced-match\package.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\resources\app\node_modules\balanced-match\package.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\resources\app\node_modules\balanced-match\package.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8c433bdff33bc1a104702005a1ecdfce

SHA1
336d29a09b7e8643cef980f38019da6e045f547a

SHA256
d5f3ddeaed73ab5be635faf05e992cb0310bf45bd364fa5ab7b4c2a38f988c3e

SHA512
eb91d7024ab61c91f7db4bce3ec2e3fe314681f02f32cb48ba424db729fe1118cef8e831a11816690c797274a93891a7d6958ece7e1874a6e98a0317b6bb78bb

Download Submit