0ccf9d46633ad337dd31852311e9c4e7906c579af584a9eb77725360a6028ba5

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/ar.pak
Size

829KB
MD5

f529e644ac3f062283d68e65241a54bb
SHA1

b36ff7369cf2c68fcc93dbfb4b36e6c90748323b
SHA256

7b6d035dcf6cf17ed7dbf055eaa6d1b2cf39c1d18743a540622602c3462bc919
SHA512

dc7f609b9061617fb425dd3000c54c5e52be8bf49df6c64df6384ef54232244418cbb78f3f9bb7764de95199cfa1c84908a6bbc65df1ece1de7e626dc99c6f4c
SSDEEP

12288:nDP/7q4BukM/T/RJUX4Yxwv4UPCNakEN5KNN1++QINIpT:DL6vrt58+h

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pak	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2192	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2192	AcroRd32.exe
2192	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2772	2328	cmd.exe	29
PID 2328 wrote to memory of 2772	2328	cmd.exe	29
PID 2328 wrote to memory of 2772	2328	cmd.exe	29
PID 2772 wrote to memory of 2192	2772	rundll32.exe	30
PID 2772 wrote to memory of 2192	2772	rundll32.exe	30
PID 2772 wrote to memory of 2192	2772	rundll32.exe	30
PID 2772 wrote to memory of 2192	2772	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\ar.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\ar.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\ar.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
47d77c3d546a21a06202c0656860c82d

SHA1
2d71f8273ff1aacf08d3e0e27db8b7ca14ba931f

SHA256
8a2f2ac1df6fd1f0d347088a56d12d1db152db4a0c75c50e66ad3fa55f0dc0f2

SHA512
315ba455b4b2ddb7eb97573b1fe4a239e09e0647f67c1cf92e68d467efd48cc0cad98a919e32268755ad4327b013e50cac4e1a91cb2aa7ced80b28f4c6b03c09

Download Submit