30bb9d26bde1c90358969baa3097a8f8d84cf5dc62531af587dff8d54de60673

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/bn.pak
Size

97KB
MD5

1442225a0a7fd12ca7ed34f6ed37ff22
SHA1

80e86ce712326d37a30eef8725c6a07a26eae577
SHA256

5328bfd92b9c1ac61ca43591574118d970ae7b158abbd9d331668e94583e5b14
SHA512

cef1294cbc46edc4d13f3ea4e2639bef62795393222bbc6ced75d7ffd4fbac78cb304fdea10484bfbf75ddfc64bf89bf66946f4f9995b981ac9bef4b350e0834
SSDEEP

768:3Wcv/ZImKtO2AUIXYReB00WxIenYW+K/tsg1wVjk+1NbTr19s1VBgSlgp75vedYB:3WJsBzTr1fZ5zcEu6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pak	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2616	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2616	AcroRd32.exe
2616	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2572	2548	cmd.exe	29
PID 2548 wrote to memory of 2572	2548	cmd.exe	29
PID 2548 wrote to memory of 2572	2548	cmd.exe	29
PID 2572 wrote to memory of 2616	2572	rundll32.exe	30
PID 2572 wrote to memory of 2616	2572	rundll32.exe	30
PID 2572 wrote to memory of 2616	2572	rundll32.exe	30
PID 2572 wrote to memory of 2616	2572	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\bn.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\bn.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\bn.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
966f62cbcae62e288f627b3fba2d0d44

SHA1
a6f03d76afacaa59018f206d09a8ffcd197f26a1

SHA256
c3b8c0debbf6559dd68b9d2e71c73c95f405caa2c6048684e9c6ffce33ee9a73

SHA512
34b3a8e905822b6e3a6527a46240f9532e9275b188725472c6ffd83273eb26a7521425b58012b58f3c04306795d2c23b791c43af9e61cfc3a456eec0b5a39e0e

Download Submit