18ce929380ab15f9e9d23d156ff3cff56b94e33641a40379f57e7adc91130c3f

Resubmissions

09/04/2024, 22:11 UTC

240409-131wtaea38 8

09/04/2024, 21:43 UTC

240409-1k5r2scg65 7

09/04/2024, 21:18 UTC

240409-z5mxasbe59 7

06/04/2024, 10:55 UTC

240406-mz7nashc59 8

06/04/2024, 10:41 UTC

240406-mrjaqsgd6z 7

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 10:41 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/cs.pak
Size

377KB
MD5

3e2c49143f4718ddd9c1c74f8599fac2
SHA1

7cce45de66a3895c3493b998fef7bedf045b29e2
SHA256

08e40f5efc616cdc0588fb4b1a706d997c69d17ddaf97eb91a4aabafaa11cee6
SHA512

a849ca0d09e0d4c025d9de6c8008c13e13581961c321f53a552deeaa210db891914386fd51673615aec8b5d8d68a921a968db5d0fe447963892ceb0948861e3d
SSDEEP

6144:QhKH/gwYPl/XACAjRe15q8+Y1zAXn5q8QM:9fgdPl/Q3e15q8+Y1AXnF

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pak	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2416	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2416	AcroRd32.exe
2416	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2612	2244	cmd.exe	29
PID 2244 wrote to memory of 2612	2244	cmd.exe	29
PID 2244 wrote to memory of 2612	2244	cmd.exe	29
PID 2612 wrote to memory of 2416	2612	rundll32.exe	32
PID 2612 wrote to memory of 2416	2612	rundll32.exe	32
PID 2612 wrote to memory of 2416	2612	rundll32.exe	32
PID 2612 wrote to memory of 2416	2612	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\cs.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\cs.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\cs.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6ac0e7ecff345475b9d66ced18a2f264

SHA1
224c6a03c25089f2265cbb008953d3227edfc6c9

SHA256
3762ac805bee52a0a19bb7b549b5cb75af40b41da7b79e51b1bdb99d70a78dcf

SHA512
3ffaa6deb56921a8a12889abe3fe1021af4d64ddc0db0fb0980f99e39c34162abcaec96ec18e384ad3427a0aa18132ba0d0c4b788b716224694249c984ac66e8

Download Submit