Overview
overview
3Static
static
3idleon.zip
windows7-x64
1idleon.zip
windows10-2004-x64
1InjectCheatsF5.exe
windows7-x64
1InjectCheatsF5.exe
windows10-2004-x64
1cheats.js
windows7-x64
3cheats.js
windows10-2004-x64
3config.cus...ple.js
windows7-x64
3config.cus...ple.js
windows10-2004-x64
3config.js
windows7-x64
3config.js
windows10-2004-x64
3main.js
windows7-x64
3main.js
windows10-2004-x64
3package-lock.json
windows7-x64
3package-lock.json
windows10-2004-x64
3package.json
windows7-x64
3package.json
windows10-2004-x64
3Resubmissions
16-08-2024 20:36
240816-zdtwjawakc 316-08-2024 20:31
240816-za2rzayfml 716-08-2024 19:15
240816-xybjkssakc 3Analysis
-
max time kernel
102s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
16-08-2024 19:15
Static task
static1
Behavioral task
behavioral1
Sample
idleon.zip
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
idleon.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
InjectCheatsF5.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
InjectCheatsF5.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
cheats.js
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
cheats.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
config.custom.example.js
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
config.custom.example.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
config.js
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
config.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
main.js
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
main.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
package-lock.json
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
package-lock.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
package.json
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
package.json
Resource
win10v2004-20240802-en
General
-
Target
package-lock.json
-
Size
6KB
-
MD5
b24081f0801fd70c8093cf19af16457a
-
SHA1
db59b39172defc4d1019c558a4960a3f5ffc9637
-
SHA256
c79c17338ef719ee450e288bc034d4eec316bebe375519979fe81b025bc3125d
-
SHA512
7b0ada7a9baed29836fbe461f66c1f90494e8242e560fa2965094e0198b5716011d81c6646820a996fe8c04c305f5eee6f813bef4cd499cffff29b35e78fbff0
-
SSDEEP
192:aa7a6pV0qfsLrQAqlaoU8j6YiRfaKK2Kn+qrQzDaoPF1AA:aabRAivWhI2VzDp1r
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\json_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\json_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\json_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.json rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2704 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2704 AcroRd32.exe 2704 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1028 wrote to memory of 2744 1028 cmd.exe rundll32.exe PID 1028 wrote to memory of 2744 1028 cmd.exe rundll32.exe PID 1028 wrote to memory of 2744 1028 cmd.exe rundll32.exe PID 2744 wrote to memory of 2704 2744 rundll32.exe AcroRd32.exe PID 2744 wrote to memory of 2704 2744 rundll32.exe AcroRd32.exe PID 2744 wrote to memory of 2704 2744 rundll32.exe AcroRd32.exe PID 2744 wrote to memory of 2704 2744 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\package-lock.json1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\package-lock.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\package-lock.json"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5a726432a2f00b1e4ac49f98b2830cfc5
SHA124bf738afa1ddaf50256c8b3d4c823e4e843b427
SHA25661912f7179f264c2330e012e72546e2b4e505c235ac4440ba01d63a4f0d51a9c
SHA5127aa520597dfac065e08f50ccacf2766d3c49762532ad9628e8d110f75b58f8f81dd398b0ec2c251a284881d8f518e7279d4e1e602a567236bb6ce66bf41bc46d