6f75e4e4094e055f39022d677bd04e89f58fa9934c2ad4e10dda4c4b41b0b3e1

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aura/com/google/gson/Gson$1.class
Size

1KB
MD5

45bc906b919ec12d77cd287d80742222
SHA1

76b222ac86d090fae06004283e82544a479ea999
SHA256

6f0ffe661cfc115101d0f58ea4db9bd81267e94ad644cace0343b6060f4e45ab
SHA512

f76ebbc359b1562984ce9e7eae75ffb91d445072758e4c92ce5d186bb986d63f2e0960cb5e66d998af8d5a71faad7def321236edc98966d02c8e9d7a65f9c3a8

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2836	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2836	AcroRd32.exe
2836	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2408	2456	cmd.exe	32
PID 2456 wrote to memory of 2408	2456	cmd.exe	32
PID 2456 wrote to memory of 2408	2456	cmd.exe	32
PID 2408 wrote to memory of 2836	2408	rundll32.exe	33
PID 2408 wrote to memory of 2836	2408	rundll32.exe	33
PID 2408 wrote to memory of 2836	2408	rundll32.exe	33
PID 2408 wrote to memory of 2836	2408	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Aura\com\google\gson\Gson$1.class
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Aura\com\google\gson\Gson$1.class
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Aura\com\google\gson\Gson$1.class"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5ed5bc90bff6ff076723a4c42e9f4b29

SHA1
a1a7ed46fbe6165bbf57c84ea3d6e2c02c46a5dd

SHA256
ea7cb5acbd59669af99bd171bfdbfddfc2904c4e4b95f0f2404dd42c104e26a9

SHA512
6570ced4e95614363f9b8746258534533f302481359fb791f7ad726b5957be7f824073992db8ca4e214c31f5bd611ac8d4121034560d21a54ed4a1ab11e03530

Download Submit