55337dd9224f9000e7cd253bb5a203613c9e8c176b9403ff2d4a784cfd214a1c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/01/2025, 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

package.json
Size

441B
MD5

8b51196db01a3f2d2e046878e2b17e0b
SHA1

1f778164dfd6c825777864d81cab25ca9819a0ae
SHA256

293d46719a8d26e8639a4b0870e587c14bf60c5cc3e8aef04fc06a71424696d1
SHA512

23f359d407f3696010150b35023acb7dd4c824d576fb727ba96967f96cd2d9a5d6a23e5a687622044639b448685caeffa6b2c999bd21ea42f1729ccf36f64143

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2172	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2172	AcroRd32.exe
2172	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2560	2168	cmd.exe	31
PID 2168 wrote to memory of 2560	2168	cmd.exe	31
PID 2168 wrote to memory of 2560	2168	cmd.exe	31
PID 2560 wrote to memory of 2172	2560	rundll32.exe	32
PID 2560 wrote to memory of 2172	2560	rundll32.exe	32
PID 2560 wrote to memory of 2172	2560	rundll32.exe	32
PID 2560 wrote to memory of 2172	2560	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\package.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\package.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\package.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2c4ad0e8128c8073fa43ae4f6e675201

SHA1
3e3aa08698f996465a0eef616b0bd71d15c0fe32

SHA256
5a07d846057b22a2e4079703a3cdbad659793fca690b0141611445f2d97d66d0

SHA512
94a61fd3f86c43e0a58664a34b73f5bdfe9bdb695eea3a24dc333763942a25effc2e2f7e8b487331c0bb340bb2b455b8175dfb2ccc8679969662b50ebd086d79

Download Submit