0ccf9d46633ad337dd31852311e9c4e7906c579af584a9eb77725360a6028ba5

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/ca.pak
Size

524KB
MD5

9e3ea2baf7e6c6101fb6b5b92c797bdb
SHA1

c181dcd37141d955d85be56e3e08d37c17feaacc
SHA256

b4efc6026115b7fac9f6b9cd360dfdd570cb5a16faf38d549fcad2b80e5f1fd2
SHA512

90e9609764847285d82894b3c4d98496fb9002c0cecae092e71b7d43d8871bd1463898d82b6a65a530ba76ecf403a30a01485f2f16e376a773f6fdf8f302e402
SSDEEP

12288:PUKf2nke7kREeopxA3n5PqF4N3Mw2juwHzejm0t3lvq8+x92fR+IsjcmlLEYjCJw:PimY6RR6QZIMN7vsyL5jGjiu

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pak	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2716	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2716	AcroRd32.exe
2716	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2584	2340	cmd.exe	29
PID 2340 wrote to memory of 2584	2340	cmd.exe	29
PID 2340 wrote to memory of 2584	2340	cmd.exe	29
PID 2584 wrote to memory of 2716	2584	rundll32.exe	30
PID 2584 wrote to memory of 2716	2584	rundll32.exe	30
PID 2584 wrote to memory of 2716	2584	rundll32.exe	30
PID 2584 wrote to memory of 2716	2584	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\ca.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\ca.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\ca.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
830b3fbe7ddf9e7719c0380059d79738

SHA1
9df0f37003e5b4a0e2aa3661d73c0aab7296c181

SHA256
61ba015a6991e89a5892ab61ec679376d6c17df497ab17697059b66ea1ddf289

SHA512
d6c959030c931b875e0155f377bfb39b2d1a94af52af396df3bdc73c6ffbcfbea3061d6c4d20bec8c77241aada5dc5ab72d3edc9f9d037301cf3a579e942d43e

Download Submit