Resubmissions

23-02-2024 11:52

240223-n18gnafd9v 10

23-02-2024 08:58

240223-kxe46aea3y 10

Analysis

  • max time kernel
    121s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23-02-2024 11:52

General

  • Target

    Resource/resources.pak

  • Size

    4.9MB

  • MD5

    df15387bf046715cc592a690da33e4b1

  • SHA1

    ad93b08dff82cbd894f6a0a9733c70d7e564113d

  • SHA256

    11d0f55c105883d203137a87a610ba793299dc4774fd6d8b3a86666a2c337041

  • SHA512

    71244553d7b1b559fcaaa059622c340d22148bd5324fa3f6730d37322025dbfe5e853948b49b91db6022a25bca4ddbab8fe6ee1522a461963dfba04a7c93d69a

  • SSDEEP

    98304:b6zN1Kt66I0+1Yk93pPVrXh188CYCUrwr1ISgMRQK8nXCpGm5vEybt:+zjKt66bGVrhm8hCUkrGsyCV5vXbt

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Resource\resources.pak
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2812
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Resource\resources.pak
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Resource\resources.pak"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    02fb92de41c824c3104f0d4c766faaf7

    SHA1

    980d36729702c55463cf4dbf6bb6105990e84da9

    SHA256

    41822af678abec3b61ea7e82b227757f12a5c7d584b86c43754014af87b38a4a

    SHA512

    2e1eb999d04a6d67a23fa088c2ce9a8f203b9dbe27984e73338a269dc7a77ceddbd7e7e0e3322da7c379278c0374148031e39d7dedeaaf42b40cd377007a1c22