6f75e4e4094e055f39022d677bd04e89f58fa9934c2ad4e10dda4c4b41b0b3e1

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aura/com/google/gson/FieldNamingPolicy$3.class
Size

938B
MD5

8e72cd9d484797032505dee1dc723d74
SHA1

f0d8f30a0f9db59bd00fdbb1eb114d642c491e7f
SHA256

4b2d181c33d3ca363a787995b2b54ad817c06be36a4d63bd7eeeb49a27e67133
SHA512

46d507ffc0713901f3bed2f31103370f794f5442992ab98a6ebfe0f4592245da86c9abd167199df85607a524ac105e7a921ad6faa32676db1740447930e2820e

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2908	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2908	AcroRd32.exe
2908	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2944	2080	cmd.exe	32
PID 2080 wrote to memory of 2944	2080	cmd.exe	32
PID 2080 wrote to memory of 2944	2080	cmd.exe	32
PID 2944 wrote to memory of 2908	2944	rundll32.exe	33
PID 2944 wrote to memory of 2908	2944	rundll32.exe	33
PID 2944 wrote to memory of 2908	2944	rundll32.exe	33
PID 2944 wrote to memory of 2908	2944	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Aura\com\google\gson\FieldNamingPolicy$3.class
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Aura\com\google\gson\FieldNamingPolicy$3.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Aura\com\google\gson\FieldNamingPolicy$3.class"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b9ddae7c21a71da281423209b23f3116

SHA1
e718415e0613ce7c944e1d2eb233055592737737

SHA256
fcc0e02bbe491628b4590c29fd1476f045a559d016860a8303251e0a929d560a

SHA512
a424ccab4c744f18bb625497f9171f03973e0464103e0c933c6608460e22a7f9021ba48f7c4667c732175efa9484871b3954f71e046629040c8393b7966584ca

Download Submit