4d8daf45a5fcf7480739974e1d9ecac7370462f66196dd14b9a38020120dc202

Resubmissions

02/06/2024, 23:20

240602-3bvxlaag6v 7

02/06/2024, 23:16

240602-29dwasbg87 4

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

chrome_200_percent.pak
Size

191KB
MD5

81b5b74fe16c7c81870f539d5c263397
SHA1

27526cc2b68a6d2b539bd75317a20c9c5e43c889
SHA256

cb4fd141a5c4d188a3ecb203e9d41a3afca648724160e212289adcac666fbff4
SHA512

b2670e2dfa495ccc7874c21d0413cfbebfd4a2f14fc0217e823ec6a16ac1181f8e06bfe7c2d32543167bc3a2e929c7f0af1a5f90182e95913ba2292fa7cadb80
SSDEEP

3072:A4DQYaE/N6gbrvy/+JPnKmWVlBafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+Hxf:A4DQYaSN6gnvyWnKmWVlSgx5GMRejnbA

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pak	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2052	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2052	AcroRd32.exe
2052	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2612	1712	cmd.exe	29
PID 1712 wrote to memory of 2612	1712	cmd.exe	29
PID 1712 wrote to memory of 2612	1712	cmd.exe	29
PID 2612 wrote to memory of 2052	2612	rundll32.exe	30
PID 2612 wrote to memory of 2052	2612	rundll32.exe	30
PID 2612 wrote to memory of 2052	2612	rundll32.exe	30
PID 2612 wrote to memory of 2052	2612	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\chrome_200_percent.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\chrome_200_percent.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\chrome_200_percent.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
20b9e6de40cc2ae02dfce741ffbbad72

SHA1
337dc35b3309a475c6d02011113f0d995a49f13c

SHA256
5f448ca5ac0d702e95ec244b1357cbbf22833336121587e73f741bcd77995497

SHA512
bf75154c267fcf80c7c7d9d46d17095aab6e1f289211634aa240a3a8255af59bf14db14d28e1966ab068dd757f362bfb707581ed45c0c6e049d0f7290c0d8736

Download Submit