Overview
overview
3Static
static
1Pizza_Load....1.jar
windows7-x64
1Pizza_Load....1.jar
windows10-2004-x64
1org/sponge....class
windows7-x64
3org/sponge....class
windows10-2004-x64
3org/sponge....class
windows7-x64
3org/sponge....class
windows10-2004-x64
3org/sponge....class
windows7-x64
3org/sponge....class
windows10-2004-x64
3org/sponge...e.html
windows7-x64
3org/sponge...e.html
windows10-2004-x64
3org/sponge....class
windows7-x64
3org/sponge....class
windows10-2004-x64
3org/sponge....class
windows7-x64
3org/sponge....class
windows10-2004-x64
3org/sponge....class
windows7-x64
3org/sponge....class
windows10-2004-x64
3org/sponge....class
windows7-x64
3org/sponge....class
windows10-2004-x64
3org/sponge....class
windows7-x64
3org/sponge....class
windows10-2004-x64
3org/sponge....class
windows7-x64
3org/sponge....class
windows10-2004-x64
3org/sponge....class
windows7-x64
3org/sponge....class
windows10-2004-x64
3org/sponge....class
windows7-x64
3org/sponge....class
windows10-2004-x64
3org/sponge....class
windows7-x64
3org/sponge....class
windows10-2004-x64
3org/sponge....class
windows7-x64
3org/sponge....class
windows10-2004-x64
3org/sponge....class
windows7-x64
3org/sponge....class
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-09-2024 19:43
Static task
static1
Behavioral task
behavioral1
Sample
Pizza_Loader_Premium_V2.2.1.jar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Pizza_Loader_Premium_V2.2.1.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
org/spongepowered/asm/lib/signature/SignatureReader.class
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
org/spongepowered/asm/lib/signature/SignatureReader.class
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
org/spongepowered/asm/lib/signature/SignatureVisitor.class
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
org/spongepowered/asm/lib/signature/SignatureVisitor.class
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
org/spongepowered/asm/lib/signature/SignatureWriter.class
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
org/spongepowered/asm/lib/signature/SignatureWriter.class
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
org/spongepowered/asm/lib/signature/package.html
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
org/spongepowered/asm/lib/signature/package.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
org/spongepowered/asm/lib/tree/AbstractInsnNode.class
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
org/spongepowered/asm/lib/tree/AbstractInsnNode.class
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
org/spongepowered/asm/lib/tree/AnnotationNode.class
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
org/spongepowered/asm/lib/tree/AnnotationNode.class
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
org/spongepowered/asm/lib/tree/ClassNode.class
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
org/spongepowered/asm/lib/tree/ClassNode.class
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
org/spongepowered/asm/lib/tree/FieldInsnNode.class
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
org/spongepowered/asm/lib/tree/FieldInsnNode.class
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
org/spongepowered/asm/lib/tree/FieldNode.class
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
org/spongepowered/asm/lib/tree/FieldNode.class
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
org/spongepowered/asm/lib/tree/FrameNode.class
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
org/spongepowered/asm/lib/tree/FrameNode.class
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
org/spongepowered/asm/lib/tree/IincInsnNode.class
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
org/spongepowered/asm/lib/tree/IincInsnNode.class
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
org/spongepowered/asm/lib/tree/InnerClassNode.class
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
org/spongepowered/asm/lib/tree/InnerClassNode.class
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
org/spongepowered/asm/lib/tree/InsnList$InsnListIterator.class
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
org/spongepowered/asm/lib/tree/InsnList$InsnListIterator.class
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
org/spongepowered/asm/lib/tree/InsnList.class
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
org/spongepowered/asm/lib/tree/InsnList.class
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
org/spongepowered/asm/lib/tree/InsnNode.class
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
org/spongepowered/asm/lib/tree/InsnNode.class
Resource
win10v2004-20240802-en
General
-
Target
org/spongepowered/asm/lib/signature/SignatureWriter.class
-
Size
2KB
-
MD5
ef5c41f3cad7a4933460f2c69373813b
-
SHA1
85627b99273845bc402c297eb70ce756b36ed46c
-
SHA256
d26fdb52fe33834570eb6298eb90661aa58422fc96862a5d49a65d688027876d
-
SHA512
51bc9eb24fdac83fa0d1fcd88849f4df41073f7b3dada09e378ee1f48fe4792d92025f4695f07748e3a19d67d1272218df3a04be548fffcbb3a4ad0993cb5712
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.class rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.class\ = "class_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\class_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\class_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\class_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\class_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\class_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2836 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2836 AcroRd32.exe 2836 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1632 wrote to memory of 2928 1632 cmd.exe 31 PID 1632 wrote to memory of 2928 1632 cmd.exe 31 PID 1632 wrote to memory of 2928 1632 cmd.exe 31 PID 2928 wrote to memory of 2836 2928 rundll32.exe 32 PID 2928 wrote to memory of 2836 2928 rundll32.exe 32 PID 2928 wrote to memory of 2836 2928 rundll32.exe 32 PID 2928 wrote to memory of 2836 2928 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\org\spongepowered\asm\lib\signature\SignatureWriter.class1⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\org\spongepowered\asm\lib\signature\SignatureWriter.class2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\org\spongepowered\asm\lib\signature\SignatureWriter.class"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2836
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD51cbd453eab361aaaf517dca0ac274617
SHA13a6d5cae3c446253277c0b65184284b284d81fff
SHA256728f2aca5845a24e6743d103b1195863079b3ef6084f5139524a2cf8a4d4f510
SHA51262283a703f55ba6aa1c765d870aea6bd83dd395ed9eebef43cc6eba0e2f64a58e56004eb384180bb06f1fc289dfda390a161186fce7cb39dcf5a8019c2e1f0cd