f8a2c7bf6611cc965e76f1286fc460ec47f3d7e4353877716417cd8b553b2667

Analysis

max time kernel
1565s
max time network
1573s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/sw.pak
Size

129KB
MD5

1e4d039a17b2ec681fb139196cbcc40e
SHA1

19e3a3d8915e4e46fe3e816f891bd4fde46d8a13
SHA256

5fe75c17a678a1c131ac6aa5d676e5f5f6dd55e73f25640a219229a299ed86e4
SHA512

7a1c298994b7f346612f4ada2034b3c858d2761e92a284f0ff9431be536a4e481bbf17ed93c007213630d25bac7dea09ee6fb186433bffa773e5daa52253468b
SSDEEP

3072:12gmUYLIYC9tUDiGypkjnfNPXIAJ/AtVPGuLeH+hTfHw2L:12gm+tUDiGLfSwH+hTfHw2L

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.pak	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2660	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2660	AcroRd32.exe
2660	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 1812	2948	cmd.exe	29
PID 2948 wrote to memory of 1812	2948	cmd.exe	29
PID 2948 wrote to memory of 1812	2948	cmd.exe	29
PID 1812 wrote to memory of 2660	1812	rundll32.exe	30
PID 1812 wrote to memory of 2660	1812	rundll32.exe	30
PID 1812 wrote to memory of 2660	1812	rundll32.exe	30
PID 1812 wrote to memory of 2660	1812	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\sw.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\sw.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\sw.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a028d66e52071a416e9bfa7e52a17b19

SHA1
ff19134772f6576edee1625473773bb00d94bd9c

SHA256
340bfcad7ee985a839852ed7f9121d3d20041ba3db25c24a5dd05b8ecc54760e

SHA512
d5a290d479ec8862ace22ff633394b84c7e4f83bbd5b9fa79c6b201da3115ce86d3571c5bf0cdec8bb99d40004f4f077a2a4b8bd09789f4fc77c67d1df3d11bd

Download Submit