a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app/node_modules/child_process/package.json
Size

295B
MD5

c913f6d16eb753431d36ea482cacb065
SHA1

5cb1c8bdc60101846714e942758d888a008120e4
SHA256

104f06b6ce2e379c3bb02cdfc1918edd3ee45e1fb3c8b5c4dcd0ab122675a964
SHA512

ebbc2aa93b22df1e8cec1889022c9f7e54cf5dbdbe6568ae39c3cd355aaab154b9b8197238682dc36143fe5fe2d25f936adb21f5101dcb5aa6570eaa8ec35ade

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid	Process
2480	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid	Process
2480	AcroRd32.exe
2480	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	Process	procid_target
PID 2376 wrote to memory of 1472	2376	cmd.exe	32
PID 2376 wrote to memory of 1472	2376	cmd.exe	32
PID 2376 wrote to memory of 1472	2376	cmd.exe	32
PID 1472 wrote to memory of 2480	1472	rundll32.exe	33
PID 1472 wrote to memory of 2480	1472	rundll32.exe	33
PID 1472 wrote to memory of 2480	1472	rundll32.exe	33
PID 1472 wrote to memory of 2480	1472	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\resources\app\node_modules\child_process\package.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\resources\app\node_modules\child_process\package.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\resources\app\node_modules\child_process\package.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
195b6aabe6266b9f32ff767f4e7feb5d

SHA1
10800fa6fc665ac9ae18f2bfadd1771316c19bea

SHA256
e44ad090e924ac77a50a70258daf6b91869f61da7874d44513cffd39cf4f2702

SHA512
37ac0cd2d30713935ab13d5d6970e2eeeee2810561d3bec0bbf39f3ddc6db094a64dfbae8697b58e34c7da549ee06b4b8aa28f4871e300e413d5fbbfac64b9d3

Download Submit