dcaf229e56e1b0f267d7e99b63920150ef1c18f8bcbf4da94c9ac592c75bdbe8

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
04/08/2024, 23:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RC7 (5) (1)/First.runtimeconfig.json
Size 268B
Sample240804-3war6avale
SHA256 162d81f468bec570ec15e527433f4de5d5729ffe338ab79b22671f38760d34bd
MD5 9fcdf880f73e74cf6347f8194b9f3509
SHA1 ab571c7ed4920129c89c7e083f3c9f22597198bc
SHA512 23ea2a78914aeec443bded1e6dddb1fce61f0445c53e0428e97353dcc25e9ee80a98603069de336d57c1d12b00eb14ad59847137387df330a3925bd763f4fde1
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2760	AcroRd32.exe
2760	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 3004	2128	cmd.exe	31
PID 2128 wrote to memory of 3004	2128	cmd.exe	31
PID 2128 wrote to memory of 3004	2128	cmd.exe	31
PID 3004 wrote to memory of 2760	3004	rundll32.exe	33
PID 3004 wrote to memory of 2760	3004	rundll32.exe	33
PID 3004 wrote to memory of 2760	3004	rundll32.exe	33
PID 3004 wrote to memory of 2760	3004	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\RC7 (5) (1)\First.runtimeconfig.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RC7 (5) (1)\First.runtimeconfig.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RC7 (5) (1)\First.runtimeconfig.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 49f4c5593019dca7e44432e0c62b0e262a6487df45d46ab1ac9874e9fb046ee7
MD5 cf2186541b79a85af5ec35b03a0187bf
SHA1 c3f5deb6c8214be467c791ec41cca3aac538f266
SHA512 09bc1fe98991de0ddf0e6e469ad63dc82edf9ef07171c90a3fafcd11401b5b52ba5cf655063d3f835a971b8671dfe8a9aecbb1175155d8380d4138dec1c47fde
MD5 SHA1 SHA512

Submit Download