d3ca102b990985518abf51ba8d71af250d10d9a017cfda853bbd71eafec3de0a

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Built/osint.runtimeconfig.json
Size

458B
MD5

07b9a30265ca4e69c7016a1b6e3ffc27
SHA1

3a4af82a2695b1423aedd8b60a5c86793c011b02
SHA256

c71152bf25e40d647b2440c5b39be157a3d356106be9d5b678ab97bb87b4e782
SHA512

efd582f8edcdba5ef48d02eee5f73d83ff35071af99b49e08e0213928568d728d0856e3b903bfcccb9237f786846cf94da83139f99e9bee86287aff2071c3f1c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2596 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2596 AcroRd32.exe
2596 AcroRd32.exe

pid	process
2596	AcroRd32.exe

pid	process
2596	AcroRd32.exe
2596	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2368 wrote to memory of 2592	2368	cmd.exe	rundll32.exe
PID 2368 wrote to memory of 2592	2368	cmd.exe	rundll32.exe
PID 2368 wrote to memory of 2592	2368	cmd.exe	rundll32.exe
PID 2592 wrote to memory of 2596	2592	rundll32.exe	AcroRd32.exe
PID 2592 wrote to memory of 2596	2592	rundll32.exe	AcroRd32.exe
PID 2592 wrote to memory of 2596	2592	rundll32.exe	AcroRd32.exe
PID 2592 wrote to memory of 2596	2592	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Built\osint.runtimeconfig.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Built\osint.runtimeconfig.json
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2592

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Built\osint.runtimeconfig.json"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2596

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
8e71fea3e4d26a4a12099579509b9461

SHA1
25bfbffe99ef8b98d4d822727c319de5f006a8a1

SHA256
cd0c6ae218b1829e4d429cfc672ec50a77091963f8aeb191708c8a19449359e3

SHA512
3ecde91ad25ed99d59a8ae56351b370aaffc2dbbfb394536fee6036a97e6bff17a20c9cb4c39124c37f253b87fb8058b8bb2dd5e483acd246a4342c7ce7b9fba

Download Submit