c91917696b589529ae0794d2277d1f64dbeca7a359ea027e9e62dc82857cdd7c

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

config.json
Size

59B
MD5

638a06ed0e7ae1001b9638a768e37514
SHA1

b1a7dd695e0971b1adc27a74d241ddf9cb1ce87d
SHA256

0a54bb717afeea7905ab9688a4e8254ccd8a8e6c5ec9213354dfb4974f809ec8
SHA512

44bb78259b0b0f2c7d320e7b457bddea6a2cd1f60e24767fdbea3d58f95999c9b33633a7865287a9f279aaf1cc775500cf6ca6c3267a4262a93cd8d5d913e964

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2584	AcroRd32.exe
2584	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2812	3044	cmd.exe	31
PID 3044 wrote to memory of 2812	3044	cmd.exe	31
PID 3044 wrote to memory of 2812	3044	cmd.exe	31
PID 2812 wrote to memory of 2584	2812	rundll32.exe	32
PID 2812 wrote to memory of 2584	2812	rundll32.exe	32
PID 2812 wrote to memory of 2584	2812	rundll32.exe	32
PID 2812 wrote to memory of 2584	2812	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\config.json
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\config.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\config.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
159b7de7c3478cd6861e4046a0dafa8f

SHA1
c79d6a9acbf83e4005b7fcc9b01344aefcc0233e

SHA256
d4a40890c512093605d7edb2c68ce394d93f1a6ea28640f75d92c4e34d6ed048

SHA512
d3b683f2d0992bd85ac0f60d48bc2e652c9ba1f19a260e0ec61693aa4518771277bfa1fc92cdbba68f181c9a9b96a21526f01bf02d8cd6e60e9c0682fe4def38

Download Submit