e3d958c0be09c74f6ae0a947388ad2a52be5d149fa682badcbb24338fb0edc38

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
locales/af.pak
Size 464KB
Sample240509-k5e45aab91
SHA256 57670eae6d1871e648ad6148125ee82d08575bec5b323459fc14c3831570774a
MD5 862a2262d0e36414abbae1d9df0c7335
SHA1 605438a96645b9771a6550a649cddbb216a3a5b1
SHA512 a789a4cad72106a5c64d27709b129c4ae6284076f147b7c3fcb808b557a3468b4efe3ede28033f981335d5eab986532c0497ddd6ed24b76189fe49366692ee73
SSDEEP 12288:KYHoLheVm/Wnzo+E+VOSMKlNu+d2ZH2Jynua2VIzfXo0vIFNgRU2Sw+2Ss37xzOZ:LoL0Vm/Wnzob+wSMag+d2ZH2Jynua2V5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pak	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2512	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2512	AcroRd32.exe
2512	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2632	1924	cmd.exe	29
PID 1924 wrote to memory of 2632	1924	cmd.exe	29
PID 1924 wrote to memory of 2632	1924	cmd.exe	29
PID 2632 wrote to memory of 2512	2632	rundll32.exe	30
PID 2632 wrote to memory of 2512	2632	rundll32.exe	30
PID 2632 wrote to memory of 2512	2632	rundll32.exe	30
PID 2632 wrote to memory of 2512	2632	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\af.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\af.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\af.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 ead72f981102b175913bd645a74aa038e241086473f601bd4756ac013f6f19ed
MD5 cdb3692d3b4e3d60898db67d6b70e046
SHA1 9d81322fa881c67de55a6d672914628776766602
SHA512 57b65531b5c31712087b1696cc97380c3d11baa28e585f37723ab5ecd791a18c8cb6ba49439e22dcec30d16c2aa0030f5890f71be2853dea30fcd00bd1b29e84
MD5 SHA1 SHA512

Submit Download