7e3a6b914dc1f307b4183e9ea01d97deac47507db7880162d321ad6dcde040dc

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

error_code.json
Size

346KB
MD5

3e69d25e4de00840b4ef97f890d1687f
SHA1

2b24116474e432bc5aba9789a4b22e6dd8511561
SHA256

ba2d92cc27b62969fc7e016bfe5535b03a45c9f32c78efb2e1018d590ae6bc60
SHA512

cf1d0935c68bd42747d8434a0ceea00c6f1eb10b70698673b3a6637331208e7e139451c506a18bf64d6b7c94ad72b27ca88992e81f44c8358636d1771969fbf6
SSDEEP

6144:900nuL5Spvu14yxwkXtSGQBocvKTgCvOpwMGHa7EN28:900nuL5SpvFrBf2

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\json_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2216	2416	cmd.exe	31
PID 2416 wrote to memory of 2216	2416	cmd.exe	31
PID 2416 wrote to memory of 2216	2416	cmd.exe	31
PID 2216 wrote to memory of 2720	2216	rundll32.exe	33
PID 2216 wrote to memory of 2720	2216	rundll32.exe	33
PID 2216 wrote to memory of 2720	2216	rundll32.exe	33
PID 2216 wrote to memory of 2720	2216	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\error_code.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\error_code.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\error_code.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8d6a4acae40a5853d5a8772bd2283f3e

SHA1
aab6875648d40a93b988d6e0053487dd64b357d0

SHA256
1af54fe13c18b7609b1f4b909953358811a33b57831053c66e1736ec85ef8002

SHA512
0570c4f787aa42fa8d4ee517f49f1e350cdcc2f2dff3676c7f44e7246a58b705c690db04a2280b46c4a120b3908ef20f473d9d59ee5894fcb73dad2d20a589de

Download Submit