Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-02-2024 19:04

General

  • Target

    locales/es-419.pak

  • Size

    366KB

  • MD5

    13c6d0a268545541f325375d431b41ae

  • SHA1

    5f5c41348f00c5e5539d261c2b76ae6e3ec7af83

  • SHA256

    943fa8774ade38d57349a5d27869097a782bc06bd34c40864a85ba829457d127

  • SHA512

    09cbb2b21304ca8afa8b760b738adb5422e83550085f1aed8e8590eeef04a2b0e131e1ead6723c3e85383630c483d7720e55f71305ff4821d7822fe6d7aa4252

  • SSDEEP

    3072:rt+uPUzEx0HrKJBjQMU0dmdv5jrqMCOyu0sdzPh7buhwwJ3Os57lLfGLFg3WSszj:rt+o+I0H6nUxv5rYQQJH5sLFg3WSsTG6

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\locales\es-419.pak
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\es-419.pak
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\es-419.pak"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    1aa963bcaf13a2cd9f0b4ca0aaa913d3

    SHA1

    f36749faf622fc50f00020c81c2fd2c2b7b148a5

    SHA256

    caaa60815bf9afccea50ae0cdd753218a5c2996ae9ef4be66b21331e98893d4f

    SHA512

    23f03ea34a02442f750fef99a223b87e0aee8b6613b0c8e018a47c706a4076db41b79d9c386e23ff97324d491deb32dfdd150dbf0bc5ab966be6667271b34e78