52a46e8d079ea9ed900f3784ded4406c3819e6e479ad7d5cac10073bb0fece31

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

I18n/ja_JP/strings.mo
Size

31KB
MD5

2d91af00e4a20a893974fad7e22b7e0c
SHA1

4d25e44446ac106494118f7906e3b354eeaa8c77
SHA256

021055e8374beb632ec3e150119a360b0a979fed53d9e4b799efcf744ba3b692
SHA512

91195dbc72b7337407734c1ecc02e521db754beb16ceb2d143144a3e30bdebadb686fbbcc1fe3b44451bd05faa012a8c88100cb671f0ae8ae34a4cf72456347e
SSDEEP

768:bJtjeu7rK6a0Foxuh6e3308cvwHfWR4muM3agx7Yf:kV3uh6e337houM3lWf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.mo	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.mo\ = "mo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mo_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mo_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mo_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mo_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\mo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2596	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2596	AcroRd32.exe
2596	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1728	1160	cmd.exe	29
PID 1160 wrote to memory of 1728	1160	cmd.exe	29
PID 1160 wrote to memory of 1728	1160	cmd.exe	29
PID 1728 wrote to memory of 2596	1728	rundll32.exe	30
PID 1728 wrote to memory of 2596	1728	rundll32.exe	30
PID 1728 wrote to memory of 2596	1728	rundll32.exe	30
PID 1728 wrote to memory of 2596	1728	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\I18n\ja_JP\strings.mo
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\I18n\ja_JP\strings.mo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\I18n\ja_JP\strings.mo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
761a8f6d8d500276c17636a99448dabe

SHA1
2f6ebe41468e4529eec4e5415d17f89a4cac92dd

SHA256
aa2fe0b9a72206c787c004c62583fe59d79beebf0cbf551088c9997a09fd0ee6

SHA512
823567dd51c3a38a5df794764cc87f4bbffb7519c0fe26f700740d3e0ea62b14a39cdfd8a67919fb1d9dde7f47427488f8ba6df696c2a244295103cd5027823d

Download Submit