6f75e4e4094e055f39022d677bd04e89f58fa9934c2ad4e10dda4c4b41b0b3e1

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aura/com/google/gson/FieldNamingPolicy$4.class
Size

1017B
MD5

b6ff58cf12f38aa187ad63373e7f0d64
SHA1

c1977bb944de0a845f1aaf75994e6aa88cd0c265
SHA256

6a1d5d22b865e5c24e32fdc23513d6c1f0c25bc4d8f10621a165df5c37a0f024
SHA512

f7ea16cd742d6ceb19ace29ec8bf311714ce907950c91b924e90776c05e701312678970a34e6d3020becf3dbb8381ebd48aabc522f814fabb7fbf0f89c4e5b65

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1404	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1404	AcroRd32.exe
1404	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2840	2672	cmd.exe	32
PID 2672 wrote to memory of 2840	2672	cmd.exe	32
PID 2672 wrote to memory of 2840	2672	cmd.exe	32
PID 2840 wrote to memory of 1404	2840	rundll32.exe	33
PID 2840 wrote to memory of 1404	2840	rundll32.exe	33
PID 2840 wrote to memory of 1404	2840	rundll32.exe	33
PID 2840 wrote to memory of 1404	2840	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Aura\com\google\gson\FieldNamingPolicy$4.class
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Aura\com\google\gson\FieldNamingPolicy$4.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Aura\com\google\gson\FieldNamingPolicy$4.class"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b952e7bad37aad7d23583e542f2b3779

SHA1
4308a3d797f79754c279a2906de26a78e6879713

SHA256
3c43ea9213ecde467d87537cbd53d1453fde979320fbf83a49ba1eefc659c4d3

SHA512
22036297d4a73bbf35eb8e362a653b93d481b1aa6e4d9e9981287348e6d65fb50f5fca7ae31a798b0a436df6faf652cb70f2bacbaf26cab8e6be6b02c9c326a3

Download Submit