7635079472f751071c32a41949affd5f1e70a9f01c173f8e1ba0ae41302ea97e

Analysis

max time kernel
102s
max time network
33s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RJ01082861-PC/resources.pak
Size

4.4MB
MD5

e1707a3ff8d331d3908635c3475397c5
SHA1

953dbb6bf99935cce81e13fd9ec61c824b50754c
SHA256

dd99b71d581134cc00a64384db245861b4879cf2c0d637f02e80c668b50e0064
SHA512

a631957f125ad0592cba8f3c91d1afafbe98fadd1f41bac93a1591d1e439c57dc540ecc9ffe742dfe6ea670ba58112c2c853266b7155f500ecd27032564e187f
SSDEEP

49152:LZAD5gRqm/EhC9L1MKxiu1vU0t+7udGJWCpL37w9l4G1hdAK5JCAVitJUJ11UmH9:LeFwRX0AcK11h6tEF

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pak	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2680	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2680	AcroRd32.exe
2680	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2632	1692	cmd.exe	29
PID 1692 wrote to memory of 2632	1692	cmd.exe	29
PID 1692 wrote to memory of 2632	1692	cmd.exe	29
PID 2632 wrote to memory of 2680	2632	rundll32.exe	30
PID 2632 wrote to memory of 2680	2632	rundll32.exe	30
PID 2632 wrote to memory of 2680	2632	rundll32.exe	30
PID 2632 wrote to memory of 2680	2632	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\resources.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\resources.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\resources.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
db7cd5b6925b85c2d791200b588eb706

SHA1
6d29a5dab4dfcdb107adb1428dd41faced56008e

SHA256
aa56e0b9a088eac7ade13d6b99d239f5b63f244137862afca7f8c30a0ce24a6f

SHA512
636d68068df9cdb40015a7071dbffb77a03130f3cdc3e4b320201c3ae46c71139aec1b4ceeb51391eb652a58195f673855f25f1a78b2abd27d42b83f53482f13

Download Submit