eb4a7d75e1661dc1d9e158317a788eaf1c280da115c0c78662d0cba514b1e59b

Analysis

max time kernel
162s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/02/2023, 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup/Locales/cs.pak
Size

327KB
MD5

2a0cf0a8a2a45da8cc44adf47bbe5cba
SHA1

f29e257d23cf5a7e881be277cf0b3ae3b59742e1
SHA256

b3977c1243ff03a035fbe859c1aa9a44c243283c17601979823fa59c229ea2fe
SHA512

073bba4a62617dc5f6a3d1dd874451fbde5ba08e7a09a2935d1b772031db8b5be10b9f47a099076acf3cd1a29bcd4ceb6116755cdb3240f44fa94c9244a9b5b2
SSDEEP

6144:Ght+SgKAwa5QlAozP15ym//lDJ/V8QRsm:mJPAwaGvP15ym3lDlj

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.pak	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
816	AcroRd32.exe
816	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 1776	972	cmd.exe	28
PID 972 wrote to memory of 1776	972	cmd.exe	28
PID 972 wrote to memory of 1776	972	cmd.exe	28
PID 1776 wrote to memory of 816	1776	rundll32.exe	29
PID 1776 wrote to memory of 816	1776	rundll32.exe	29
PID 1776 wrote to memory of 816	1776	rundll32.exe	29
PID 1776 wrote to memory of 816	1776	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Setup\Locales\cs.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Setup\Locales\cs.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Setup\Locales\cs.pak"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-82-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/972-54-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp

Filesize
8KB

Download