c2e26ecea5f1261a2d81205271e534d54b7c445e8e6badefe11c12dae4d63baf

Analysis

max time kernel
1s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 19:37

Target

locales\af.pak
Size

327KB
MD5

f78831d4aec1d0e1735ad630f9e8f4ce
SHA1

4afc52c9d2e0fba6aff22596bf876621a7d88a27
SHA256

219d94355d0c460516f9baa83f4b8dcd3353ce13e7648f019810047ee8eecb41
SHA512

ffbf51a4ff656edd65575ae4d1f489281e3ef08e1e5bb05daac9786958d1af832520e6ed77ed197e0160e368fb56bf303f8779bcdcbe77d995364a433024d65f
SSDEEP

6144:ZLgVKc+kVWlEvC9Z5D49Em7kLjB6oAYxjYgDbwxesB+xSK1qA3y25tHwDwv22iGe:ZEdclEvC2im4LjB6oAYxjYgDbwAVSK1Q

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2696	1656	cmd.exe	18
PID 1656 wrote to memory of 2696	1656	cmd.exe	18
PID 1656 wrote to memory of 2696	1656	cmd.exe	18

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\af.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\af.pak
  2⤵
  PID:2696
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\af.pak"
    3⤵
    PID:2812

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact