be75f94398e7a9b047cf025f8b2b1effe4e3c3b8f607a1edec61d8682831525d

Analysis

max time kernel
360s
max time network
361s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

! §4§lCHATO GAP RGB/assets/minecraft/models/item/beef.json
Size

93B
MD5

a53b85ac80d18048a7e68b07cfda81aa
SHA1

3474008546b29d8fb3e9375adf99f531e710b632
SHA256

00ff3241df0d197a0d71ba2f696be23ac1e625af2ac50c1b1071ef52d5a08e4e
SHA512

517ef62738f4bf497f12f592abb3909618111ba0f38eeccee8a8ed2bb8c817cebadc3b716b7cf6985bbc9135b8456b061a8dcbdd6c738711f050d4bd791cdcb8

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\json_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2604	AcroRd32.exe
2604	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2856	2704	cmd.exe	32
PID 2704 wrote to memory of 2856	2704	cmd.exe	32
PID 2704 wrote to memory of 2856	2704	cmd.exe	32
PID 2856 wrote to memory of 2604	2856	rundll32.exe	33
PID 2856 wrote to memory of 2604	2856	rundll32.exe	33
PID 2856 wrote to memory of 2604	2856	rundll32.exe	33
PID 2856 wrote to memory of 2604	2856	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\! §4§lCHATO GAP RGB\assets\minecraft\models\item\beef.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\! §4§lCHATO GAP RGB\assets\minecraft\models\item\beef.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\! §4§lCHATO GAP RGB\assets\minecraft\models\item\beef.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
77ee22efa6ddcb1744e888f14f36d20a

SHA1
a43c7cc8aa0ba563f46a1e9b5045b30e7dd97c41

SHA256
8fd4c614ab51d0dd20c924ea8662e38ad447c19f281e6171a38c12d2278b54c1

SHA512
9ae84c304b535934df9f7ef68216b4a7d0451b1837261cbdb8aefced01db11dee5b55d090d4cd6a6f9e514efdede834fe42dbc26a2008c2ae7facd9130dec4a0

Download Submit