f8a2c7bf6611cc965e76f1286fc460ec47f3d7e4353877716417cd8b553b2667

Analysis

max time kernel
1561s
max time network
1571s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
locales/sr.pak
Size 203KB
Sample240203-a89sssdbd6
SHA256 a8daa930b1ede6d93e774314a47d1301302a25e275f09f2cfe798315d66f702b
MD5 fe305dfcac5d6126c94124f183842fe8
SHA1 e5362a293acb534ff293ad002bbbdff1300ed25a
SHA512 90e5d3057e6cfdd4d92c1f4c8fa0953c4acc52789780b52e43a0f195950423e6d167c5022be0362fdc00ca663c9969d2ae41290f8ff76510fd902afe9a17ee31
SSDEEP 6144:E/GJX060oDT9M6ea+sS1r37sTn59bwfJ/k/ZN:cAXB029T+sSN37u5WJ/k/P
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\pak_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\pak_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.pak	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2728	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2728	AcroRd32.exe
2728	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2072	2980	cmd.exe	29
PID 2980 wrote to memory of 2072	2980	cmd.exe	29
PID 2980 wrote to memory of 2072	2980	cmd.exe	29
PID 2072 wrote to memory of 2728	2072	rundll32.exe	30
PID 2072 wrote to memory of 2728	2072	rundll32.exe	30
PID 2072 wrote to memory of 2728	2072	rundll32.exe	30
PID 2072 wrote to memory of 2728	2072	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\sr.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\sr.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\sr.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 5cab133f913aa40d733a84686906c0f5acde4eb142481a8bc316f5db978d8284
MD5 baa9143443c6d89c83fda65c8dc19db2
SHA1 5a21a23fd536722bfeaf9f5568b2fa006555d149
SHA512 8b0faa1029e5dd3176481588f2b7993e9fbda784407aa263a95af9ee9b9818a471bd9a647262787b1fb43334aa69a45d3d1149526c5b9cd63c841d2b2a02ebda
MD5 SHA1 SHA512

Submit Download